XDP Frame Size Miscalculation in Linux Kernel

Executive Summary

This vulnerability exists in the Linux kernel's mvpp2 network driver, specifically related to the handling of XDP (eXpress Data Path) frame sizes.

The mvpp2 driver has two buffer pools: short and long. Short pool buffers can be smaller than the system's PAGE_SIZE, but the XDP path incorrectly initializes every xdp_buff with a frame size equal to PAGE_SIZE.

XDP helpers rely on the frame size to validate packet tail growth and to determine the boundary of the data area. By advertising a frame size of PAGE_SIZE for smaller buffers, it allows the function bpf_xdp_adjust_tail() to extend a packet beyond its actual allocated memory.

This can lead to memory corruption or cause later checks on the socket buffer's tailroom to fail.

The fix involves initializing the XDP buffer with the actual fragment size of the buffer pool, so that the tailroom matches the real buffer backing the packet.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to memory corruption in the Linux kernel's network stack.

Memory corruption can cause system instability, crashes, or unexpected behavior in network packet processing.

Additionally, it may allow attackers or malicious code to exploit the corrupted memory to escalate privileges or execute arbitrary code, depending on the system context.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability has been resolved by initializing the XDP buffer with the actual buffer size (bm_pool->frag_size) instead of PAGE_SIZE to ensure the XDP tailroom matches the real buffer backing the packet.

To mitigate this vulnerability, you should update your Linux kernel to a version that includes this fix for the mvpp2 driver.

Useful 0 Not Useful 0