Fragment Reassembly Length Bypass in Linux Kernel

Executive Summary

This vulnerability exists in the Linux kernel component called batman-adv, which manages fragment reassembly of network packets.

Batman-adv keeps track of the total payload length of queued fragments to validate the fragment chain before reassembly.

However, the current method allows the accumulated fragment length to be truncated during updates, which means malformed fragment chains can bypass validation.

This leads to inconsistent length states during reassembly, causing a local denial of service.

The fix involves storing the accumulated length in a length-typed field and rejecting any update overflows before validation.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to a local denial of service (DoS) on systems running the affected batman-adv component in the Linux kernel.

An attacker could exploit malformed fragment chains to bypass validation and cause the system to enter an inconsistent state during packet reassembly, potentially disrupting normal network operations.

Useful 0 Not Useful 0