CVE-2024-49948

net: add more sanity checks to qdisc_pkt_len_init()

State: Published
Severity: Not scored
Published: Oct 21, 2024
Updated: Oct 15, 2026
Reserved: Oct 21, 2024

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

net: add more sanity checks to qdisc_pkt_len_init()

One path takes care of SKB_GSO_DODGY, assuming skb->len is bigger than hdr_len.

virtio_net_hdr_to_skb() does not fully dissect TCP headers, it only make sure it is at least 20 bytes.

It is possible for an user to provide a malicious 'GSO' packet, total length of 80 bytes.

- 20 bytes of IPv4 header - 60 bytes TCP header - a small gso_size like 8

virtio_net_hdr_to_skb() would declare this packet as a normal GSO packet, because it would see 40 bytes of payload, bigger than gso_size.

We need to make detect this case to not underflow qdisc_skb_cb(skb)->pkt_len.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	1def9238d4aa2146924994aa4b7dc861f03b9362 to before d7d1a28f5dd57b4d83def876f8d7b4403bd37df9Affected 1def9238d4aa2146924994aa4b7dc861f03b9362 to before 473426a1d53a68dd1e718e6cd00d57936993fa6cAffected 1def9238d4aa2146924994aa4b7dc861f03b9362 to before 566a931a1436d0e0ad13708ea55479b95426213cAffected 1def9238d4aa2146924994aa4b7dc861f03b9362 to before 2415f465730e48b6e38da1c7c097317bf5dd2d20Affected 1def9238d4aa2146924994aa4b7dc861f03b9362 to before 27a8fabc54d2f960d47bdfbebf2bdc6e8a92a4c4Affected 1def9238d4aa2146924994aa4b7dc861f03b9362 to before 9b0ee571d20a238a22722126abdfde61f1b2bdd0Affected 1def9238d4aa2146924994aa4b7dc861f03b9362 to before ff1c3cadcf405ab37dd91418a62a7acecf3bc5e2Affected 1def9238d4aa2146924994aa4b7dc861f03b9362 to before 1eebe602a8d8264a12e35e39d0645fa88dbbacddAffected 1def9238d4aa2146924994aa4b7dc861f03b9362 to before ab9a9a9e9647392a19e7a885b08000e89c86b535Affected
LinuxLinux	3.9Affected before 3.9Not affected 4.19.323 through 4.19.Not affected 5.4.285 through 5.4.Not affected 5.10.227 through 5.10.Not affected 5.15.168 through 5.15.Not affected 6.1.113 through 6.1.Not affected 6.6.55 through 6.6.Not affected 6.10.14 through 6.10.Not affected 6.11.3 through 6.11.Not affected 6.12 and laterNot affected

Product

Versions

LinuxLinux

1def9238d4aa2146924994aa4b7dc861f03b9362 to before d7d1a28f5dd57b4d83def876f8d7b4403bd37df9Affected
1def9238d4aa2146924994aa4b7dc861f03b9362 to before 473426a1d53a68dd1e718e6cd00d57936993fa6cAffected
1def9238d4aa2146924994aa4b7dc861f03b9362 to before 566a931a1436d0e0ad13708ea55479b95426213cAffected
1def9238d4aa2146924994aa4b7dc861f03b9362 to before 2415f465730e48b6e38da1c7c097317bf5dd2d20Affected
1def9238d4aa2146924994aa4b7dc861f03b9362 to before 27a8fabc54d2f960d47bdfbebf2bdc6e8a92a4c4Affected
1def9238d4aa2146924994aa4b7dc861f03b9362 to before 9b0ee571d20a238a22722126abdfde61f1b2bdd0Affected
1def9238d4aa2146924994aa4b7dc861f03b9362 to before ff1c3cadcf405ab37dd91418a62a7acecf3bc5e2Affected
1def9238d4aa2146924994aa4b7dc861f03b9362 to before 1eebe602a8d8264a12e35e39d0645fa88dbbacddAffected
1def9238d4aa2146924994aa4b7dc861f03b9362 to before ab9a9a9e9647392a19e7a885b08000e89c86b535Affected

LinuxLinux

3.9Affected
before 3.9Not affected
4.19.323 through 4.19.*Not affected
5.4.285 through 5.4.*Not affected
5.10.227 through 5.10.*Not affected
5.15.168 through 5.15.*Not affected
6.1.113 through 6.1.*Not affected
6.6.55 through 6.6.*Not affected
6.10.14 through 6.10.*Not affected
6.11.3 through 6.11.*Not affected
6.12 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.