CVE-2024-43897 — Improper Validation of Specified Quantity in Input in Linux
Severity
5.5MEDIUMNVD
EPSS
0.0%
top 93.34%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedAug 26
Description
In the Linux kernel, the following vulnerability has been resolved:
net: drop bad gso csum_start and offset in virtio_net_hdr
Tighten csum_start and csum_offset checks in virtio_net_hdr_to_skb
for GSO packets.
The function already checks that a checksum requested with
VIRTIO_NET_HDR_F_NEEDS_CSUM is in skb linear. But for GSO packets
this might not hold for segs after segmentation.
Syzkaller demonstrated to reach this warning in skb_checksum_help
offset = skb_checksum_start_offset(skb);
ret …
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 1.8 | Impact: 3.6
Affected Packages9 packages
▶CVEListV5linux/linux27874ca77bd2b05a3779c7b3a5c75d8dd7f0b40f — 413e785a89f8bde0d4156a54b8ac2fa003c06756+8
Patches
🔴Vulnerability Details
2OSV▶
CVE-2024-43897: In the Linux kernel, the following vulnerability has been resolved: net: drop bad gso csum_start and offset in virtio_net_hdr Tighten csum_start and c↗2024-08-26
GHSA▶
GHSA-44m4-gm9r-m853: In the Linux kernel, the following vulnerability has been resolved:
net: drop bad gso csum_start and offset in virtio_net_hdr
Tighten csum_start and↗2024-08-26