kernel: backport "net: gro: don't merge zcopy skbs" (CVE-pending)#17414
Open
omkhar wants to merge 1 commit into
Open
kernel: backport "net: gro: don't merge zcopy skbs" (CVE-pending)#17414omkhar wants to merge 1 commit into
omkhar wants to merge 1 commit into
Conversation
Author
|
@microsoft-github-policy-service agree |
Collaborator
|
Thanks for the contribution, @omkhar . We're taking a closer look at the backport and will follow up shortly. In the meantime, please retarget the PR to our cc: @allenpais |
microsoft-github-policy-service
Bot
added
specs-extended
Backport upstream commit 4db79a322db8 ("net: gro: don't merge zcopy
skbs") into the Azure Linux 3.0 kernel-6.6.139.1 package.
skb_gro_receive() can currently copy frags between the source and GRO
skb without checking the zerocopy status, in particular the
SKBFL_MANAGED_FRAG_REFS flag. When SKBFL_MANAGED_FRAG_REFS is set, the
skb doesn't hold a reference on the pages in shinfo->frags. Appending
those frags to another skb's frags without fixing up the page refcount
leads to a use-after-free.
The fix returns -ETOOMANYREFS from skb_gro_receive() when either skb is
zerocopy, preventing the merge. Equivalent to the upstream net.git
commit and the same one-line addition shipping in stable kernels.
Fixes: 753f1ca4e1e5 ("net: introduce managed frags infrastructure")
Upstream-Status: Backport [4db79a322db8c97f7b73b8a347395ef4d685eb40]
Upstream-Author: Sabrina Dubroca <sd@queasysnail.net>
Reported-by: Huzaifa Sidhpurwala <huzaifas@redhat.com>
Verified empirically on Azure F32s_v2 VM running 6.6.139.1-grofix:
public PoC (lcfr-eth/2566a5cef312c94a5ff8d62fa417955f) succeeded 4/5
trials on unpatched 6.6.139.1; succeeded 0/5 on patched kernel (page
poisoning sentinel observed in PTE[0] each trial - UAF prevented).
`gro.sh` selftest passes ("All Tests Succeeded").
Author
|
Retargeted to |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Backports upstream commit
4db79a322db8("net: gro: don't merge zcopy skbs") into the Azure Linux 3.0kernel-6.6.139.1package. The fix prevents a UAF inskb_gro_receive()that allows unprivileged LPE via io_uringSEND_ZC+ veth GRO.Why this matters for Azure Linux 3
SKBFL_MANAGED_FRAG_REFS, introduced upstream by753f1ca4e1e5) is present in 6.6 LTS → 6.6.139.1kernel.io_uring_disabled=0)6.6.139.1-1.azl3(Azure D2as_v5 VM, F32s_v2 build VM)Change
SPECS/kernel/0002-net-gro-don-t-merge-zcopy-skbs.patch— 3-line addition tonet/core/gro.c'sskb_gro_receive()returning-ETOOMANYREFSwhen either skb is zero-copy%autosetup -p1so the patch auto-applies during%prepReleasebumped to2%{?dist}; changelog entry addedEmpirical verification (Azure)
Built and booted
kernel-6.6.139.1-2.azl3.x86_64(6.6.139.1-grofix) on an F32s_v2 VM:6.6.139.1-1.azl36.6.139.1-grofixlcfr-eth/2566a5cef312c94a5ff8d62fa417955f) over 5 trialshax::0:0::/root:/bin/shinjected into/etc/passwd)0xdeadbeefdeadbeefobserved)tools/testing/selftests/net/gro.shskb_gro_receivedisasm — `skb_zcopy(p)Test plan
%autosetupagainstkernel-6.6.139.1-1.azl3SRPMmake -j12 vmlinux bzImage modules)References
4db79a322db8c97f7b73b8a347395ef4d685eb40753f1ca4e1e5("net: introduce managed frags infrastructure")<sd@queasysnail.net><huzaifas@redhat.com>🤖 Generated with Claude Code