CyberRota Analysis
AI-GeneratedThe vulnerability affects the Linux kernel's handling of IPv4 packet fragmentation during paged memory allocation, where the allocation length does not properly account for fraggap bytes, leading to potential memory corruption. This flaw can result in denial-of-service conditions or arbitrary code execution, making it critical for organizations using Linux systems to prioritize patching. System administrators and security teams should address this vulnerability promptly to mitigate risks associated with network packet processing.
Original NVD Description
In the Linux kernel, the following vulnerability has been resolved: ipv4: account for fraggap on the paged allocation path In __ip_append_data(), when the paged-allocation branch is taken, alloclen and pagedlen are computed as alloclen = fragheaderlen + transhdrlen; pagedlen = datalen - transhdrlen; datalen already includes fraggap, but the fraggap bytes carried over from the previous skb are copied into the new skb's linear area at offset transhdrlen by the subsequent skb_copy_and_csum_bits(). The linear area is therefore undersized by fraggap bytes while pagedlen is overstated by the same amount. The non-paged branch sets alloclen to fraglen, which already accounts for fraggap because datalen does. Bring the paged branch in line by adding fraggap to alloclen and subtracting it from pagedlen. After this adjustment, copy no longer collapses to -fraggap on the paged path, so remove the stale comment describing that old arithmetic.
Related CVEs
Other vulnerabilities affecting the same vendor(s)