oss-sec mailing list archives
CVE Request: another recursion in GRE
From: Marcus Meissner <meissner () suse de>
Date: Thu, 13 Oct 2016 18:10:41 +0200
Hi, While debugging the issue CVE-2016-7039, SUSE engineer Michal Kubecek also spotted a similar problem fixed earlier this year. If a packet has the layout: | IPv4 header | GRE header | IPv4 header | GRE header | ... depending on left over stack it could run the kernel out of stack due to recursion and so crash the kernel. This might be hard to hit with regular Ethernet MTUs, but easier with Jumbo frames. Michal has a testcase in https://bugzilla.suse.com/show_bug.cgi?id=1001486#c5 As far as I see fixed in 4.6, introduced in 3.13 (bf5a755f). commit fac8e0f579695a3ecbc4d3cac369139d7f819971 Author: Jesse Gross <jesse () kernel org> Date: Sat Mar 19 09:32:01 2016 -0700 tunnels: Don't apply GRO to multiple layers of encapsulation. When drivers express support for TSO of encapsulated packets, they only mean that they can do it for one layer of encapsulation. Supporting additional levels would mean updating, at a minimum, more IP length fields and they are unaware of this. No encapsulation device expresses support for handling offloaded encapsulated packets, so we won't generate these types of frames in the transmit path. However, GRO doesn't have a check for multiple levels of encapsulation and will attempt to build them. UDP tunnel GRO actually does prevent this situation but it only handles multiple UDP tunnels stacked on top of each other. This generalizes that solution to prevent any kind of tunnel stacking that would cause problems. Fixes: bf5a755f ("net-gre-gro: Add GRE support to the GRO stack") Signed-off-by: Jesse Gross <jesse () kernel org> Signed-off-by: David S. Miller <davem () davemloft net> Ciao, Marcus
Current thread:
- CVE Request: another recursion in GRE Marcus Meissner (Oct 13)
- Re: CVE Request: another recursion in GRE cve-assign (Oct 14)