Executive Summary

This vulnerability exists in the Linux kernel's rxrpc component, specifically in the ACK parser that handles the SACK (Selective Acknowledgement) table. The issue involves improper handling and modification of the received skbuff (socket buffer) in the function rxrpc_input_soft_acks().

The vulnerability arises because AF_RXRPC assumes it can call skb_condense() to flatten the buffer and then access the SACK table directly from skb->data. However, skb_condense() can fail silently under certain conditions, especially with fragmented UDP packets, leading to potential incorrect access or modification of the buffer.

Additionally, the function rxrpc_input_ack() unnecessarily calls skb_condense(), which is not needed and could contribute to the problem. The vulnerability was fixed by correcting the ACK parser to properly extract the SACK table without relying on skb_condense() and by fixing the modification of the skbuff.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could lead to incorrect parsing and handling of network packets within the rxrpc protocol in the Linux kernel. Specifically, it may cause improper access or modification of fragmented UDP packet buffers.

An attacker might exploit this by deliberately crafting fragmented UDP packets to trigger the faulty parsing logic, potentially causing unexpected behavior such as data corruption, denial of service, or other stability issues in the kernel's network stack.

Useful 0 Not Useful 0