Message-ID: <2025070328-CVE-2025-38124-bc19@gregkh>
Date: Thu,  3 Jul 2025 10:35:41 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2025-38124: net: fix udp gso skb_segment after pull from frag_list

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

net: fix udp gso skb_segment after pull from frag_list

Commit a1e40ac5b5e9 ("net: gso: fix udp gso fraglist segmentation after
pull from frag_list") detected invalid geometry in frag_list skbs and
redirects them from skb_segment_list to more robust skb_segment. But some
packets with modified geometry can also hit bugs in that code. We don't
know how many such cases exist. Addressing each one by one also requires
touching the complex skb_segment code, which risks introducing bugs for
other types of skbs. Instead, linearize all these packets that fail the
basic invariants on gso fraglist skbs. That is more robust.

If only part of the fraglist payload is pulled into head_skb, it will
always cause exception when splitting skbs by skb_segment. For detailed
call stack information, see below.

Valid SKB_GSO_FRAGLIST skbs
- consist of two or more segments
- the head_skb holds the protocol headers plus first gso_size
- one or more frag_list skbs hold exactly one segment
- all but the last must be gso_size

Optional datapath hooks such as NAT and BPF (bpf_skb_pull_data) can
modify fraglist skbs, breaking these invariants.

In extreme cases they pull one part of data into skb linear. For UDP,
this  causes three payloads with lengths of (11,11,10) bytes were
pulled tail to become (12,10,10) bytes.

The skbs no longer meets the above SKB_GSO_FRAGLIST conditions because
payload was pulled into head_skb, it needs to be linearized before pass
to regular skb_segment.

    skb_segment+0xcd0/0xd14
    __udp_gso_segment+0x334/0x5f4
    udp4_ufo_fragment+0x118/0x15c
    inet_gso_segment+0x164/0x338
    skb_mac_gso_segment+0xc4/0x13c
    __skb_gso_segment+0xc4/0x124
    validate_xmit_skb+0x9c/0x2c0
    validate_xmit_skb_list+0x4c/0x80
    sch_direct_xmit+0x70/0x404
    __dev_queue_xmit+0x64c/0xe5c
    neigh_resolve_output+0x178/0x1c4
    ip_finish_output2+0x37c/0x47c
    __ip_finish_output+0x194/0x240
    ip_finish_output+0x20/0xf4
    ip_output+0x100/0x1a0
    NF_HOOK+0xc4/0x16c
    ip_forward+0x314/0x32c
    ip_rcv+0x90/0x118
    __netif_receive_skb+0x74/0x124
    process_backlog+0xe8/0x1a4
    __napi_poll+0x5c/0x1f8
    net_rx_action+0x154/0x314
    handle_softirqs+0x154/0x4b8

    [118.376811] [C201134] rxq0_pus: [name:bug&]kernel BUG at net/core/skbuff.c:4278!
    [118.376829] [C201134] rxq0_pus: [name:traps&]Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP
    [118.470774] [C201134] rxq0_pus: [name:mrdump&]Kernel Offset: 0x178cc00000 from 0xffffffc008000000
    [118.470810] [C201134] rxq0_pus: [name:mrdump&]PHYS_OFFSET: 0x40000000
    [118.470827] [C201134] rxq0_pus: [name:mrdump&]pstate: 60400005 (nZCv daif +PAN -UAO)
    [118.470848] [C201134] rxq0_pus: [name:mrdump&]pc : [0xffffffd79598aefc] skb_segment+0xcd0/0xd14
    [118.470900] [C201134] rxq0_pus: [name:mrdump&]lr : [0xffffffd79598a5e8] skb_segment+0x3bc/0xd14
    [118.470928] [C201134] rxq0_pus: [name:mrdump&]sp : ffffffc008013770

The Linux kernel CVE team has assigned CVE-2025-38124 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.1.113 with commit 080e6c9a3908de193a48f646c5ce1bfb15676ffc and fixed in 6.1.142 with commit 0e65f38bd1aa14ea86e221b7bb814d38278d86c3
	Issue introduced in 6.6.55 with commit af3122f5fdc0d00581d6e598a668df6bf54c9daa and fixed in 6.6.94 with commit 85eef1748c024da1a191aed56b30a3a65958c50c
	Issue introduced in 6.12 with commit a1e40ac5b5e9077fe1f7ae0eb88034db0f9ae1ab and fixed in 6.12.34 with commit 4399f59a9467a324ed46657555f0e1f209a14acb
	Issue introduced in 6.12 with commit a1e40ac5b5e9077fe1f7ae0eb88034db0f9ae1ab and fixed in 6.15.3 with commit a04302867094bdc6efac1b598370fc47cf3f2388
	Issue introduced in 6.12 with commit a1e40ac5b5e9077fe1f7ae0eb88034db0f9ae1ab and fixed in 6.16-rc1 with commit 3382a1ed7f778db841063f5d7e317ac55f9e7f72
	Issue introduced in 6.10.14 with commit 33e28acf42ee863f332a958bfc2f1a284a3659df
	Issue introduced in 6.11.3 with commit 3cd00d2e3655fad3bda96dc1ebf17b6495f86fea

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2025-38124
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/ipv4/udp_offload.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/0e65f38bd1aa14ea86e221b7bb814d38278d86c3
	https://git.kernel.org/stable/c/85eef1748c024da1a191aed56b30a3a65958c50c
	https://git.kernel.org/stable/c/4399f59a9467a324ed46657555f0e1f209a14acb
	https://git.kernel.org/stable/c/a04302867094bdc6efac1b598370fc47cf3f2388
	https://git.kernel.org/stable/c/3382a1ed7f778db841063f5d7e317ac55f9e7f72

Powered by blists - more mailing lists