CVE-2024-36933 (GCVE-0-2024-36933)

Vulnerability from cvelistv5 – Published: 2024-05-30 15:29 – Updated: 2026-05-11 20:17
VLAI
Title
nsh: Restore skb->{protocol,data,mac_header} for outer header in nsh_gso_segment().
Summary
In the Linux kernel, the following vulnerability has been resolved: nsh: Restore skb->{protocol,data,mac_header} for outer header in nsh_gso_segment(). syzbot triggered various splats (see [0] and links) by a crafted GSO packet of VIRTIO_NET_HDR_GSO_UDP layering the following protocols: ETH_P_8021AD + ETH_P_NSH + ETH_P_IPV6 + IPPROTO_UDP NSH can encapsulate IPv4, IPv6, Ethernet, NSH, and MPLS. As the inner protocol can be Ethernet, NSH GSO handler, nsh_gso_segment(), calls skb_mac_gso_segment() to invoke inner protocol GSO handlers. nsh_gso_segment() does the following for the original skb before calling skb_mac_gso_segment() 1. reset skb->network_header 2. save the original skb->{mac_heaeder,mac_len} in a local variable 3. pull the NSH header 4. resets skb->mac_header 5. set up skb->mac_len and skb->protocol for the inner protocol. and does the following for the segmented skb 6. set ntohs(ETH_P_NSH) to skb->protocol 7. push the NSH header 8. restore skb->mac_header 9. set skb->mac_header + mac_len to skb->network_header 10. restore skb->mac_len There are two problems in 6-7 and 8-9. (a) After 6 & 7, skb->data points to the NSH header, so the outer header (ETH_P_8021AD in this case) is stripped when skb is sent out of netdev. Also, if NSH is encapsulated by NSH + Ethernet (so NSH-Ethernet-NSH), skb_pull() in the first nsh_gso_segment() will make skb->data point to the middle of the outer NSH or Ethernet header because the Ethernet header is not pulled by the second nsh_gso_segment(). (b) While restoring skb->{mac_header,network_header} in 8 & 9, nsh_gso_segment() does not assume that the data in the linear buffer is shifted. However, udp6_ufo_fragment() could shift the data and change skb->mac_header accordingly as demonstrated by syzbot. If this happens, even the restored skb->mac_header points to the middle of the outer header. It seems nsh_gso_segment() has never worked with outer headers so far. At the end of nsh_gso_segment(), the outer header must be restored for the segmented skb, instead of the NSH header. To do that, let's calculate the outer header position relatively from the inner header and set skb->{data,mac_header,protocol} properly. [0]: BUG: KMSAN: uninit-value in ipvlan_process_outbound drivers/net/ipvlan/ipvlan_core.c:524 [inline] BUG: KMSAN: uninit-value in ipvlan_xmit_mode_l3 drivers/net/ipvlan/ipvlan_core.c:602 [inline] BUG: KMSAN: uninit-value in ipvlan_queue_xmit+0xf44/0x16b0 drivers/net/ipvlan/ipvlan_core.c:668 ipvlan_process_outbound drivers/net/ipvlan/ipvlan_core.c:524 [inline] ipvlan_xmit_mode_l3 drivers/net/ipvlan/ipvlan_core.c:602 [inline] ipvlan_queue_xmit+0xf44/0x16b0 drivers/net/ipvlan/ipvlan_core.c:668 ipvlan_start_xmit+0x5c/0x1a0 drivers/net/ipvlan/ipvlan_main.c:222 __netdev_start_xmit include/linux/netdevice.h:4989 [inline] netdev_start_xmit include/linux/netdevice.h:5003 [inline] xmit_one net/core/dev.c:3547 [inline] dev_hard_start_xmit+0x244/0xa10 net/core/dev.c:3563 __dev_queue_xmit+0x33ed/0x51c0 net/core/dev.c:4351 dev_queue_xmit include/linux/netdevice.h:3171 [inline] packet_xmit+0x9c/0x6b0 net/packet/af_packet.c:276 packet_snd net/packet/af_packet.c:3081 [inline] packet_sendmsg+0x8aef/0x9f10 net/packet/af_packet.c:3113 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg net/socket.c:745 [inline] __sys_sendto+0x735/0xa10 net/socket.c:2191 __do_sys_sendto net/socket.c:2203 [inline] __se_sys_sendto net/socket.c:2199 [inline] __x64_sys_sendto+0x125/0x1c0 net/socket.c:2199 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b Uninit was created at: slab_post_alloc_hook mm/slub.c:3819 [inline] slab_alloc_node mm/slub.c:3860 [inline] __do_kmalloc_node mm/slub.c:3980 [inline] __kmalloc_node_track_caller+0x705/0x1000 mm/slub.c:4001 kmalloc_reserve+0x249/0x4a0 net/core/skbuff.c:582 __ ---truncated---
Severity
No CVSS data available.
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: c411ed854584a71b0e86ac3019b60e4789d88086 , < a7c2c3c1caabcb4a3d6c47284c397507aaf54fe9 (git)
Affected: c411ed854584a71b0e86ac3019b60e4789d88086 , < 46134031c20fd313d03b90169d64b2e05ca6b65c (git)
Affected: c411ed854584a71b0e86ac3019b60e4789d88086 , < bbccf0caef2fa917d6d0692385a06ce3c262a216 (git)
Affected: c411ed854584a71b0e86ac3019b60e4789d88086 , < 5a4603fbc285752d19e4b415466db18ef3617e4a (git)
Affected: c411ed854584a71b0e86ac3019b60e4789d88086 , < 37ed6f244ec5bda2e90b085084e322ea55d0aaa2 (git)
Affected: c411ed854584a71b0e86ac3019b60e4789d88086 , < 696d18bb59727a2e0526c0802a812620be1c9340 (git)
Affected: c411ed854584a71b0e86ac3019b60e4789d88086 , < 29a07f2ee4d273760c2acbfc756e29eccd82470a (git)
Affected: c411ed854584a71b0e86ac3019b60e4789d88086 , < 4b911a9690d72641879ea6d13cce1de31d346d79 (git)
Create a notification for this product.
Linux Linux Affected: 4.14
Unaffected: 0 , < 4.14 (semver)
Unaffected: 4.19.314 , ≤ 4.19.* (semver)
Unaffected: 5.4.276 , ≤ 5.4.* (semver)
Unaffected: 5.10.217 , ≤ 5.10.* (semver)
Unaffected: 5.15.159 , ≤ 5.15.* (semver)
Unaffected: 6.1.91 , ≤ 6.1.* (semver)
Unaffected: 6.6.31 , ≤ 6.6.* (semver)
Unaffected: 6.8.10 , ≤ 6.8.* (semver)
Unaffected: 6.9 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-36933",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-04T15:40:25.095830Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:47:53.616Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-09-12T16:02:59.824Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/a7c2c3c1caabcb4a3d6c47284c397507aaf54fe9"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/46134031c20fd313d03b90169d64b2e05ca6b65c"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/bbccf0caef2fa917d6d0692385a06ce3c262a216"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/5a4603fbc285752d19e4b415466db18ef3617e4a"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/37ed6f244ec5bda2e90b085084e322ea55d0aaa2"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/696d18bb59727a2e0526c0802a812620be1c9340"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/29a07f2ee4d273760c2acbfc756e29eccd82470a"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/4b911a9690d72641879ea6d13cce1de31d346d79"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00019.html"
          },
          {
            "url": "https://security.netapp.com/advisory/ntap-20240912-0006/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/nsh/nsh.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a7c2c3c1caabcb4a3d6c47284c397507aaf54fe9",
              "status": "affected",
              "version": "c411ed854584a71b0e86ac3019b60e4789d88086",
              "versionType": "git"
            },
            {
              "lessThan": "46134031c20fd313d03b90169d64b2e05ca6b65c",
              "status": "affected",
              "version": "c411ed854584a71b0e86ac3019b60e4789d88086",
              "versionType": "git"
            },
            {
              "lessThan": "bbccf0caef2fa917d6d0692385a06ce3c262a216",
              "status": "affected",
              "version": "c411ed854584a71b0e86ac3019b60e4789d88086",
              "versionType": "git"
            },
            {
              "lessThan": "5a4603fbc285752d19e4b415466db18ef3617e4a",
              "status": "affected",
              "version": "c411ed854584a71b0e86ac3019b60e4789d88086",
              "versionType": "git"
            },
            {
              "lessThan": "37ed6f244ec5bda2e90b085084e322ea55d0aaa2",
              "status": "affected",
              "version": "c411ed854584a71b0e86ac3019b60e4789d88086",
              "versionType": "git"
            },
            {
              "lessThan": "696d18bb59727a2e0526c0802a812620be1c9340",
              "status": "affected",
              "version": "c411ed854584a71b0e86ac3019b60e4789d88086",
              "versionType": "git"
            },
            {
              "lessThan": "29a07f2ee4d273760c2acbfc756e29eccd82470a",
              "status": "affected",
              "version": "c411ed854584a71b0e86ac3019b60e4789d88086",
              "versionType": "git"
            },
            {
              "lessThan": "4b911a9690d72641879ea6d13cce1de31d346d79",
              "status": "affected",
              "version": "c411ed854584a71b0e86ac3019b60e4789d88086",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/nsh/nsh.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.14"
            },
            {
              "lessThan": "4.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.314",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.276",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.217",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.159",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.91",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.31",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.314",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.276",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.217",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.159",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.91",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.31",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.10",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnsh: Restore skb-\u003e{protocol,data,mac_header} for outer header in nsh_gso_segment().\n\nsyzbot triggered various splats (see [0] and links) by a crafted GSO\npacket of VIRTIO_NET_HDR_GSO_UDP layering the following protocols:\n\n  ETH_P_8021AD + ETH_P_NSH + ETH_P_IPV6 + IPPROTO_UDP\n\nNSH can encapsulate IPv4, IPv6, Ethernet, NSH, and MPLS.  As the inner\nprotocol can be Ethernet, NSH GSO handler, nsh_gso_segment(), calls\nskb_mac_gso_segment() to invoke inner protocol GSO handlers.\n\nnsh_gso_segment() does the following for the original skb before\ncalling skb_mac_gso_segment()\n\n  1. reset skb-\u003enetwork_header\n  2. save the original skb-\u003e{mac_heaeder,mac_len} in a local variable\n  3. pull the NSH header\n  4. resets skb-\u003emac_header\n  5. set up skb-\u003emac_len and skb-\u003eprotocol for the inner protocol.\n\nand does the following for the segmented skb\n\n  6. set ntohs(ETH_P_NSH) to skb-\u003eprotocol\n  7. push the NSH header\n  8. restore skb-\u003emac_header\n  9. set skb-\u003emac_header + mac_len to skb-\u003enetwork_header\n 10. restore skb-\u003emac_len\n\nThere are two problems in 6-7 and 8-9.\n\n  (a)\n  After 6 \u0026 7, skb-\u003edata points to the NSH header, so the outer header\n  (ETH_P_8021AD in this case) is stripped when skb is sent out of netdev.\n\n  Also, if NSH is encapsulated by NSH + Ethernet (so NSH-Ethernet-NSH),\n  skb_pull() in the first nsh_gso_segment() will make skb-\u003edata point\n  to the middle of the outer NSH or Ethernet header because the Ethernet\n  header is not pulled by the second nsh_gso_segment().\n\n  (b)\n  While restoring skb-\u003e{mac_header,network_header} in 8 \u0026 9,\n  nsh_gso_segment() does not assume that the data in the linear\n  buffer is shifted.\n\n  However, udp6_ufo_fragment() could shift the data and change\n  skb-\u003emac_header accordingly as demonstrated by syzbot.\n\n  If this happens, even the restored skb-\u003emac_header points to\n  the middle of the outer header.\n\nIt seems nsh_gso_segment() has never worked with outer headers so far.\n\nAt the end of nsh_gso_segment(), the outer header must be restored for\nthe segmented skb, instead of the NSH header.\n\nTo do that, let\u0027s calculate the outer header position relatively from\nthe inner header and set skb-\u003e{data,mac_header,protocol} properly.\n\n[0]:\nBUG: KMSAN: uninit-value in ipvlan_process_outbound drivers/net/ipvlan/ipvlan_core.c:524 [inline]\nBUG: KMSAN: uninit-value in ipvlan_xmit_mode_l3 drivers/net/ipvlan/ipvlan_core.c:602 [inline]\nBUG: KMSAN: uninit-value in ipvlan_queue_xmit+0xf44/0x16b0 drivers/net/ipvlan/ipvlan_core.c:668\n ipvlan_process_outbound drivers/net/ipvlan/ipvlan_core.c:524 [inline]\n ipvlan_xmit_mode_l3 drivers/net/ipvlan/ipvlan_core.c:602 [inline]\n ipvlan_queue_xmit+0xf44/0x16b0 drivers/net/ipvlan/ipvlan_core.c:668\n ipvlan_start_xmit+0x5c/0x1a0 drivers/net/ipvlan/ipvlan_main.c:222\n __netdev_start_xmit include/linux/netdevice.h:4989 [inline]\n netdev_start_xmit include/linux/netdevice.h:5003 [inline]\n xmit_one net/core/dev.c:3547 [inline]\n dev_hard_start_xmit+0x244/0xa10 net/core/dev.c:3563\n __dev_queue_xmit+0x33ed/0x51c0 net/core/dev.c:4351\n dev_queue_xmit include/linux/netdevice.h:3171 [inline]\n packet_xmit+0x9c/0x6b0 net/packet/af_packet.c:276\n packet_snd net/packet/af_packet.c:3081 [inline]\n packet_sendmsg+0x8aef/0x9f10 net/packet/af_packet.c:3113\n sock_sendmsg_nosec net/socket.c:730 [inline]\n __sock_sendmsg net/socket.c:745 [inline]\n __sys_sendto+0x735/0xa10 net/socket.c:2191\n __do_sys_sendto net/socket.c:2203 [inline]\n __se_sys_sendto net/socket.c:2199 [inline]\n __x64_sys_sendto+0x125/0x1c0 net/socket.c:2199\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x63/0x6b\n\nUninit was created at:\n slab_post_alloc_hook mm/slub.c:3819 [inline]\n slab_alloc_node mm/slub.c:3860 [inline]\n __do_kmalloc_node mm/slub.c:3980 [inline]\n __kmalloc_node_track_caller+0x705/0x1000 mm/slub.c:4001\n kmalloc_reserve+0x249/0x4a0 net/core/skbuff.c:582\n __\n---truncated---"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T20:17:18.281Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a7c2c3c1caabcb4a3d6c47284c397507aaf54fe9"
        },
        {
          "url": "https://git.kernel.org/stable/c/46134031c20fd313d03b90169d64b2e05ca6b65c"
        },
        {
          "url": "https://git.kernel.org/stable/c/bbccf0caef2fa917d6d0692385a06ce3c262a216"
        },
        {
          "url": "https://git.kernel.org/stable/c/5a4603fbc285752d19e4b415466db18ef3617e4a"
        },
        {
          "url": "https://git.kernel.org/stable/c/37ed6f244ec5bda2e90b085084e322ea55d0aaa2"
        },
        {
          "url": "https://git.kernel.org/stable/c/696d18bb59727a2e0526c0802a812620be1c9340"
        },
        {
          "url": "https://git.kernel.org/stable/c/29a07f2ee4d273760c2acbfc756e29eccd82470a"
        },
        {
          "url": "https://git.kernel.org/stable/c/4b911a9690d72641879ea6d13cce1de31d346d79"
        }
      ],
      "title": "nsh: Restore skb-\u003e{protocol,data,mac_header} for outer header in nsh_gso_segment().",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-36933",
    "datePublished": "2024-05-30T15:29:23.764Z",
    "dateReserved": "2024-05-30T15:25:07.071Z",
    "dateUpdated": "2026-05-11T20:17:18.281Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-36933",
      "date": "2026-06-05",
      "epss": "0.0001",
      "percentile": "0.01127"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnsh: Restore skb-\u003e{protocol,data,mac_header} for outer header in nsh_gso_segment().\\n\\nsyzbot triggered various splats (see [0] and links) by a crafted GSO\\npacket of VIRTIO_NET_HDR_GSO_UDP layering the following protocols:\\n\\n  ETH_P_8021AD + ETH_P_NSH + ETH_P_IPV6 + IPPROTO_UDP\\n\\nNSH can encapsulate IPv4, IPv6, Ethernet, NSH, and MPLS.  As the inner\\nprotocol can be Ethernet, NSH GSO handler, nsh_gso_segment(), calls\\nskb_mac_gso_segment() to invoke inner protocol GSO handlers.\\n\\nnsh_gso_segment() does the following for the original skb before\\ncalling skb_mac_gso_segment()\\n\\n  1. reset skb-\u003enetwork_header\\n  2. save the original skb-\u003e{mac_heaeder,mac_len} in a local variable\\n  3. pull the NSH header\\n  4. resets skb-\u003emac_header\\n  5. set up skb-\u003emac_len and skb-\u003eprotocol for the inner protocol.\\n\\nand does the following for the segmented skb\\n\\n  6. set ntohs(ETH_P_NSH) to skb-\u003eprotocol\\n  7. push the NSH header\\n  8. restore skb-\u003emac_header\\n  9. set skb-\u003emac_header + mac_len to skb-\u003enetwork_header\\n 10. restore skb-\u003emac_len\\n\\nThere are two problems in 6-7 and 8-9.\\n\\n  (a)\\n  After 6 \u0026 7, skb-\u003edata points to the NSH header, so the outer header\\n  (ETH_P_8021AD in this case) is stripped when skb is sent out of netdev.\\n\\n  Also, if NSH is encapsulated by NSH + Ethernet (so NSH-Ethernet-NSH),\\n  skb_pull() in the first nsh_gso_segment() will make skb-\u003edata point\\n  to the middle of the outer NSH or Ethernet header because the Ethernet\\n  header is not pulled by the second nsh_gso_segment().\\n\\n  (b)\\n  While restoring skb-\u003e{mac_header,network_header} in 8 \u0026 9,\\n  nsh_gso_segment() does not assume that the data in the linear\\n  buffer is shifted.\\n\\n  However, udp6_ufo_fragment() could shift the data and change\\n  skb-\u003emac_header accordingly as demonstrated by syzbot.\\n\\n  If this happens, even the restored skb-\u003emac_header points to\\n  the middle of the outer header.\\n\\nIt seems nsh_gso_segment() has never worked with outer headers so far.\\n\\nAt the end of nsh_gso_segment(), the outer header must be restored for\\nthe segmented skb, instead of the NSH header.\\n\\nTo do that, let\u0027s calculate the outer header position relatively from\\nthe inner header and set skb-\u003e{data,mac_header,protocol} properly.\\n\\n[0]:\\nBUG: KMSAN: uninit-value in ipvlan_process_outbound drivers/net/ipvlan/ipvlan_core.c:524 [inline]\\nBUG: KMSAN: uninit-value in ipvlan_xmit_mode_l3 drivers/net/ipvlan/ipvlan_core.c:602 [inline]\\nBUG: KMSAN: uninit-value in ipvlan_queue_xmit+0xf44/0x16b0 drivers/net/ipvlan/ipvlan_core.c:668\\n ipvlan_process_outbound drivers/net/ipvlan/ipvlan_core.c:524 [inline]\\n ipvlan_xmit_mode_l3 drivers/net/ipvlan/ipvlan_core.c:602 [inline]\\n ipvlan_queue_xmit+0xf44/0x16b0 drivers/net/ipvlan/ipvlan_core.c:668\\n ipvlan_start_xmit+0x5c/0x1a0 drivers/net/ipvlan/ipvlan_main.c:222\\n __netdev_start_xmit include/linux/netdevice.h:4989 [inline]\\n netdev_start_xmit include/linux/netdevice.h:5003 [inline]\\n xmit_one net/core/dev.c:3547 [inline]\\n dev_hard_start_xmit+0x244/0xa10 net/core/dev.c:3563\\n __dev_queue_xmit+0x33ed/0x51c0 net/core/dev.c:4351\\n dev_queue_xmit include/linux/netdevice.h:3171 [inline]\\n packet_xmit+0x9c/0x6b0 net/packet/af_packet.c:276\\n packet_snd net/packet/af_packet.c:3081 [inline]\\n packet_sendmsg+0x8aef/0x9f10 net/packet/af_packet.c:3113\\n sock_sendmsg_nosec net/socket.c:730 [inline]\\n __sock_sendmsg net/socket.c:745 [inline]\\n __sys_sendto+0x735/0xa10 net/socket.c:2191\\n __do_sys_sendto net/socket.c:2203 [inline]\\n __se_sys_sendto net/socket.c:2199 [inline]\\n __x64_sys_sendto+0x125/0x1c0 net/socket.c:2199\\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\\n do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83\\n entry_SYSCALL_64_after_hwframe+0x63/0x6b\\n\\nUninit was created at:\\n slab_post_alloc_hook mm/slub.c:3819 [inline]\\n slab_alloc_node mm/slub.c:3860 [inline]\\n __do_kmalloc_node mm/slub.c:3980 [inline]\\n __kmalloc_node_track_caller+0x705/0x1000 mm/slub.c:4001\\n kmalloc_reserve+0x249/0x4a0 net/core/skbuff.c:582\\n __\\n---truncated---\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se resolvi\\u00f3 la siguiente vulnerabilidad: nsh: restaurar skb-\u0026gt;{protocol,data,mac_header} para el encabezado externo en nsh_gso_segment(). syzbot activ\\u00f3 varios s\\u00edmbolos (ver [0] y enlaces) mediante un paquete GSO manipulado de VIRTIO_NET_HDR_GSO_UDP que superpone los siguientes protocolos: ETH_P_8021AD + ETH_P_NSH + ETH_P_IPV6 + IPPROTO_UDP NSH puede encapsular IPv4, IPv6, Ethernet, NSH y MPLS. Como el protocolo interno puede ser Ethernet, el controlador NSH GSO, nsh_gso_segment(), llama a skb_mac_gso_segment() para invocar los controladores GSO del protocolo interno. nsh_gso_segment() hace lo siguiente para el skb original antes de llamar a skb_mac_gso_segment() 1. restablecer skb-\u0026gt;network_header 2. guardar el skb-\u0026gt;{mac_heaeder,mac_len} original en una variable local 3. extraer el encabezado NSH 4. restablece skb- \u0026gt;mac_header 5. Configure skb-\u0026gt;mac_len y skb-\u0026gt;protocol para el protocolo interno. y hace lo siguiente para el skb segmentado 6. configurar ntohs(ETH_P_NSH) en skb-\u0026gt;protocol 7. empujar el encabezado NSH 8. restaurar skb-\u0026gt;mac_header 9. configurar skb-\u0026gt;mac_header + mac_len en skb-\u0026gt;network_header 10. restaurar skb-\u0026gt;mac_len Hay dos problemas en 6-7 y 8-9. (a) Despu\\u00e9s de 6 y 7, skb-\u0026gt;data apunta al encabezado NSH, por lo que el encabezado externo (ETH_P_8021AD en este caso) se elimina cuando skb se env\\u00eda fuera de netdev. Adem\\u00e1s, si NSH est\\u00e1 encapsulado por NSH + Ethernet (es decir, NSH-Ethernet-NSH), skb_pull() en el primer nsh_gso_segment() har\\u00e1 que skb-\u0026gt;data apunte al medio del encabezado NSH o Ethernet externo porque el encabezado Ethernet es no arrastrado por el segundo nsh_gso_segment(). (b) Al restaurar skb-\u0026gt;{mac_header,network_header} en 8 y 9, nsh_gso_segment() no supone que los datos en el b\\u00fafer lineal se hayan desplazado. Sin embargo, udp6_ufo_fragment() podr\\u00eda cambiar los datos y cambiar skb-\u0026gt;mac_header en consecuencia, como lo demuestra syzbot. Si esto sucede, incluso el skb-\u0026gt;mac_header restaurado apunta al centro del encabezado externo. Parece que nsh_gso_segment() nunca ha funcionado con encabezados externos hasta ahora. Al final de nsh_gso_segment(), se debe restaurar el encabezado externo para el skb segmentado, en lugar del encabezado NSH. Para hacer eso, calculemos la posici\\u00f3n del encabezado externo relativamente desde el encabezado interno y configuremos skb-\u0026gt;{data,mac_header,protocol} correctamente. [0]: ERROR: KMSAN: valor uninit en ipvlan_process_outbound drivers/net/ipvlan/ipvlan_core.c:524 [en l\\u00ednea] ERROR: KMSAN: valor uninit en ipvlan_xmit_mode_l3 drivers/net/ipvlan/ipvlan_core.c:602 [en l\\u00ednea] ERROR: KMSAN: valor uninit en ipvlan_queue_xmit+0xf44/0x16b0 drivers/net/ipvlan/ipvlan_core.c:668 ipvlan_process_outbound drivers/net/ipvlan/ipvlan_core.c:524 [en l\\u00ednea] ipvlan_xmit_mode_l3 drivers/net/ipvlan/ipvlan_core.c: 602 [en l\\u00ednea] ipvlan_queue_xmit+0xf44/0x16b0 drivers/net/ipvlan/ipvlan_core.c:668 ipvlan_start_xmit+0x5c/0x1a0 drivers/net/ipvlan/ipvlan_main.c:222 __netdev_start_xmit include/linux/netdevice.h:4989 [en l\\u00ednea] _xmitir include/linux/netdevice.h:5003 [en l\\u00ednea] xmit_one net/core/dev.c:3547 [en l\\u00ednea] dev_hard_start_xmit+0x244/0xa10 net/core/dev.c:3563 __dev_queue_xmit+0x33ed/0x51c0 net/core/dev. c:4351 dev_queue_xmit include/linux/netdevice.h:3171 [en l\\u00ednea] paquete_xmit+0x9c/0x6b0 net/packet/af_packet.c:276 paquete_snd net/packet/af_packet.c:3081 [en l\\u00ednea] paquete_sendmsg+0x8aef/0x9f10 net/ paquete/af_packet.c:3113 sock_sendmsg_nosec net/socket.c:730 [en l\\u00ednea] __sock_sendmsg net/socket.c:745 [en l\\u00ednea] __sys_sendto+0x735/0xa10 net/socket.c:2191 __do_sys_sendto net/socket.c:2203 [ en l\\u00ednea] __se_sys_sendto net/socket.c:2199 [en l\\u00ednea] __x64_sys_sendto+0x125/0x1c0 net/socket.c:2199 do_syscall_x64 arch/x86/entry/common.c:52 [en l\\u00ednea] do_syscall_64+0xcf/0x1e0 arch/x86/entry /common.c:83 Entry_SYSCALL_64_after_hwframe+0x63/0x6b Uninit se cre\\u00f3 en: slab_post_alloc_hook mm/slub.c:3819 [en l\\u00ednea] slab_alloc_node mm/slub.c:3860 [en l\\u00ednea] __do_kmalloc_node mm/slub.c:3980---truncado---\"}]",
      "id": "CVE-2024-36933",
      "lastModified": "2024-11-21T09:22:51.043",
      "published": "2024-05-30T16:15:16.463",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/29a07f2ee4d273760c2acbfc756e29eccd82470a\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/37ed6f244ec5bda2e90b085084e322ea55d0aaa2\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/46134031c20fd313d03b90169d64b2e05ca6b65c\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/4b911a9690d72641879ea6d13cce1de31d346d79\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/5a4603fbc285752d19e4b415466db18ef3617e4a\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/696d18bb59727a2e0526c0802a812620be1c9340\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/a7c2c3c1caabcb4a3d6c47284c397507aaf54fe9\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/bbccf0caef2fa917d6d0692385a06ce3c262a216\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/29a07f2ee4d273760c2acbfc756e29eccd82470a\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/37ed6f244ec5bda2e90b085084e322ea55d0aaa2\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/46134031c20fd313d03b90169d64b2e05ca6b65c\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/4b911a9690d72641879ea6d13cce1de31d346d79\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/5a4603fbc285752d19e4b415466db18ef3617e4a\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/696d18bb59727a2e0526c0802a812620be1c9340\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/a7c2c3c1caabcb4a3d6c47284c397507aaf54fe9\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/bbccf0caef2fa917d6d0692385a06ce3c262a216\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2024/06/msg00019.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://security.netapp.com/advisory/ntap-20240912-0006/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-36933\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-05-30T16:15:16.463\",\"lastModified\":\"2026-01-22T20:03:31.133\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnsh: Restore skb-\u003e{protocol,data,mac_header} for outer header in nsh_gso_segment().\\n\\nsyzbot triggered various splats (see [0] and links) by a crafted GSO\\npacket of VIRTIO_NET_HDR_GSO_UDP layering the following protocols:\\n\\n  ETH_P_8021AD + ETH_P_NSH + ETH_P_IPV6 + IPPROTO_UDP\\n\\nNSH can encapsulate IPv4, IPv6, Ethernet, NSH, and MPLS.  As the inner\\nprotocol can be Ethernet, NSH GSO handler, nsh_gso_segment(), calls\\nskb_mac_gso_segment() to invoke inner protocol GSO handlers.\\n\\nnsh_gso_segment() does the following for the original skb before\\ncalling skb_mac_gso_segment()\\n\\n  1. reset skb-\u003enetwork_header\\n  2. save the original skb-\u003e{mac_heaeder,mac_len} in a local variable\\n  3. pull the NSH header\\n  4. resets skb-\u003emac_header\\n  5. set up skb-\u003emac_len and skb-\u003eprotocol for the inner protocol.\\n\\nand does the following for the segmented skb\\n\\n  6. set ntohs(ETH_P_NSH) to skb-\u003eprotocol\\n  7. push the NSH header\\n  8. restore skb-\u003emac_header\\n  9. set skb-\u003emac_header + mac_len to skb-\u003enetwork_header\\n 10. restore skb-\u003emac_len\\n\\nThere are two problems in 6-7 and 8-9.\\n\\n  (a)\\n  After 6 \u0026 7, skb-\u003edata points to the NSH header, so the outer header\\n  (ETH_P_8021AD in this case) is stripped when skb is sent out of netdev.\\n\\n  Also, if NSH is encapsulated by NSH + Ethernet (so NSH-Ethernet-NSH),\\n  skb_pull() in the first nsh_gso_segment() will make skb-\u003edata point\\n  to the middle of the outer NSH or Ethernet header because the Ethernet\\n  header is not pulled by the second nsh_gso_segment().\\n\\n  (b)\\n  While restoring skb-\u003e{mac_header,network_header} in 8 \u0026 9,\\n  nsh_gso_segment() does not assume that the data in the linear\\n  buffer is shifted.\\n\\n  However, udp6_ufo_fragment() could shift the data and change\\n  skb-\u003emac_header accordingly as demonstrated by syzbot.\\n\\n  If this happens, even the restored skb-\u003emac_header points to\\n  the middle of the outer header.\\n\\nIt seems nsh_gso_segment() has never worked with outer headers so far.\\n\\nAt the end of nsh_gso_segment(), the outer header must be restored for\\nthe segmented skb, instead of the NSH header.\\n\\nTo do that, let\u0027s calculate the outer header position relatively from\\nthe inner header and set skb-\u003e{data,mac_header,protocol} properly.\\n\\n[0]:\\nBUG: KMSAN: uninit-value in ipvlan_process_outbound drivers/net/ipvlan/ipvlan_core.c:524 [inline]\\nBUG: KMSAN: uninit-value in ipvlan_xmit_mode_l3 drivers/net/ipvlan/ipvlan_core.c:602 [inline]\\nBUG: KMSAN: uninit-value in ipvlan_queue_xmit+0xf44/0x16b0 drivers/net/ipvlan/ipvlan_core.c:668\\n ipvlan_process_outbound drivers/net/ipvlan/ipvlan_core.c:524 [inline]\\n ipvlan_xmit_mode_l3 drivers/net/ipvlan/ipvlan_core.c:602 [inline]\\n ipvlan_queue_xmit+0xf44/0x16b0 drivers/net/ipvlan/ipvlan_core.c:668\\n ipvlan_start_xmit+0x5c/0x1a0 drivers/net/ipvlan/ipvlan_main.c:222\\n __netdev_start_xmit include/linux/netdevice.h:4989 [inline]\\n netdev_start_xmit include/linux/netdevice.h:5003 [inline]\\n xmit_one net/core/dev.c:3547 [inline]\\n dev_hard_start_xmit+0x244/0xa10 net/core/dev.c:3563\\n __dev_queue_xmit+0x33ed/0x51c0 net/core/dev.c:4351\\n dev_queue_xmit include/linux/netdevice.h:3171 [inline]\\n packet_xmit+0x9c/0x6b0 net/packet/af_packet.c:276\\n packet_snd net/packet/af_packet.c:3081 [inline]\\n packet_sendmsg+0x8aef/0x9f10 net/packet/af_packet.c:3113\\n sock_sendmsg_nosec net/socket.c:730 [inline]\\n __sock_sendmsg net/socket.c:745 [inline]\\n __sys_sendto+0x735/0xa10 net/socket.c:2191\\n __do_sys_sendto net/socket.c:2203 [inline]\\n __se_sys_sendto net/socket.c:2199 [inline]\\n __x64_sys_sendto+0x125/0x1c0 net/socket.c:2199\\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\\n do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83\\n entry_SYSCALL_64_after_hwframe+0x63/0x6b\\n\\nUninit was created at:\\n slab_post_alloc_hook mm/slub.c:3819 [inline]\\n slab_alloc_node mm/slub.c:3860 [inline]\\n __do_kmalloc_node mm/slub.c:3980 [inline]\\n __kmalloc_node_track_caller+0x705/0x1000 mm/slub.c:4001\\n kmalloc_reserve+0x249/0x4a0 net/core/skbuff.c:582\\n __\\n---truncated---\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: nsh: restaurar skb-\u0026gt;{protocol,data,mac_header} para el encabezado externo en nsh_gso_segment(). syzbot activ\u00f3 varios s\u00edmbolos (ver [0] y enlaces) mediante un paquete GSO manipulado de VIRTIO_NET_HDR_GSO_UDP que superpone los siguientes protocolos: ETH_P_8021AD + ETH_P_NSH + ETH_P_IPV6 + IPPROTO_UDP NSH puede encapsular IPv4, IPv6, Ethernet, NSH y MPLS. Como el protocolo interno puede ser Ethernet, el controlador NSH GSO, nsh_gso_segment(), llama a skb_mac_gso_segment() para invocar los controladores GSO del protocolo interno. nsh_gso_segment() hace lo siguiente para el skb original antes de llamar a skb_mac_gso_segment() 1. restablecer skb-\u0026gt;network_header 2. guardar el skb-\u0026gt;{mac_heaeder,mac_len} original en una variable local 3. extraer el encabezado NSH 4. restablece skb- \u0026gt;mac_header 5. Configure skb-\u0026gt;mac_len y skb-\u0026gt;protocol para el protocolo interno. y hace lo siguiente para el skb segmentado 6. configurar ntohs(ETH_P_NSH) en skb-\u0026gt;protocol 7. empujar el encabezado NSH 8. restaurar skb-\u0026gt;mac_header 9. configurar skb-\u0026gt;mac_header + mac_len en skb-\u0026gt;network_header 10. restaurar skb-\u0026gt;mac_len Hay dos problemas en 6-7 y 8-9. (a) Despu\u00e9s de 6 y 7, skb-\u0026gt;data apunta al encabezado NSH, por lo que el encabezado externo (ETH_P_8021AD en este caso) se elimina cuando skb se env\u00eda fuera de netdev. Adem\u00e1s, si NSH est\u00e1 encapsulado por NSH + Ethernet (es decir, NSH-Ethernet-NSH), skb_pull() en el primer nsh_gso_segment() har\u00e1 que skb-\u0026gt;data apunte al medio del encabezado NSH o Ethernet externo porque el encabezado Ethernet es no arrastrado por el segundo nsh_gso_segment(). (b) Al restaurar skb-\u0026gt;{mac_header,network_header} en 8 y 9, nsh_gso_segment() no supone que los datos en el b\u00fafer lineal se hayan desplazado. Sin embargo, udp6_ufo_fragment() podr\u00eda cambiar los datos y cambiar skb-\u0026gt;mac_header en consecuencia, como lo demuestra syzbot. Si esto sucede, incluso el skb-\u0026gt;mac_header restaurado apunta al centro del encabezado externo. Parece que nsh_gso_segment() nunca ha funcionado con encabezados externos hasta ahora. Al final de nsh_gso_segment(), se debe restaurar el encabezado externo para el skb segmentado, en lugar del encabezado NSH. Para hacer eso, calculemos la posici\u00f3n del encabezado externo relativamente desde el encabezado interno y configuremos skb-\u0026gt;{data,mac_header,protocol} correctamente. [0]: ERROR: KMSAN: valor uninit en ipvlan_process_outbound drivers/net/ipvlan/ipvlan_core.c:524 [en l\u00ednea] ERROR: KMSAN: valor uninit en ipvlan_xmit_mode_l3 drivers/net/ipvlan/ipvlan_core.c:602 [en l\u00ednea] ERROR: KMSAN: valor uninit en ipvlan_queue_xmit+0xf44/0x16b0 drivers/net/ipvlan/ipvlan_core.c:668 ipvlan_process_outbound drivers/net/ipvlan/ipvlan_core.c:524 [en l\u00ednea] ipvlan_xmit_mode_l3 drivers/net/ipvlan/ipvlan_core.c: 602 [en l\u00ednea] ipvlan_queue_xmit+0xf44/0x16b0 drivers/net/ipvlan/ipvlan_core.c:668 ipvlan_start_xmit+0x5c/0x1a0 drivers/net/ipvlan/ipvlan_main.c:222 __netdev_start_xmit include/linux/netdevice.h:4989 [en l\u00ednea] _xmitir include/linux/netdevice.h:5003 [en l\u00ednea] xmit_one net/core/dev.c:3547 [en l\u00ednea] dev_hard_start_xmit+0x244/0xa10 net/core/dev.c:3563 __dev_queue_xmit+0x33ed/0x51c0 net/core/dev. c:4351 dev_queue_xmit include/linux/netdevice.h:3171 [en l\u00ednea] paquete_xmit+0x9c/0x6b0 net/packet/af_packet.c:276 paquete_snd net/packet/af_packet.c:3081 [en l\u00ednea] paquete_sendmsg+0x8aef/0x9f10 net/ paquete/af_packet.c:3113 sock_sendmsg_nosec net/socket.c:730 [en l\u00ednea] __sock_sendmsg net/socket.c:745 [en l\u00ednea] __sys_sendto+0x735/0xa10 net/socket.c:2191 __do_sys_sendto net/socket.c:2203 [ en l\u00ednea] __se_sys_sendto net/socket.c:2199 [en l\u00ednea] __x64_sys_sendto+0x125/0x1c0 net/socket.c:2199 do_syscall_x64 arch/x86/entry/common.c:52 [en l\u00ednea] do_syscall_64+0xcf/0x1e0 arch/x86/entry /common.c:83 Entry_SYSCALL_64_after_hwframe+0x63/0x6b Uninit se cre\u00f3 en: slab_post_alloc_hook mm/slub.c:3819 [en l\u00ednea] slab_alloc_node mm/slub.c:3860 [en l\u00ednea] __do_kmalloc_node mm/slub.c:3980---truncado---\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-908\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.14\",\"versionEndExcluding\":\"4.19.314\",\"matchCriteriaId\":\"C5E3C473-9230-4E04-BD05-2D9CF39E9FC2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.20\",\"versionEndExcluding\":\"5.4.276\",\"matchCriteriaId\":\"126C6EEC-8874-4233-AE09-634924FCDDF4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.217\",\"matchCriteriaId\":\"AC67C71C-2044-40BA-B590-61E562F69F89\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.159\",\"matchCriteriaId\":\"F16678CD-F7C6-4BF6-ABA8-E7600857197B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.91\",\"matchCriteriaId\":\"4F8C886C-75AA-469B-A6A9-12BF1A29C0D5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.31\",\"matchCriteriaId\":\"CDDB1F69-36AC-41C1-9192-E7CCEF5FFC00\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.8.10\",\"matchCriteriaId\":\"6A6B920C-8D8F-4130-86B4-AD334F4CF2E3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"22BEDD49-2C6D-402D-9DBF-6646F6ECD10B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.9:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"DF73CB2A-DFFD-46FB-9BFE-AA394F27EA37\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.9:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"52048DDA-FC5A-4363-95A0-A6357B4D7F8C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.9:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"A06B2CCF-3F43-4FA9-8773-C83C3F5764B2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.9:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"F850DCEC-E08B-4317-A33B-D2DCF39F601B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.9:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"91326417-E981-482E-A5A3-28BC1327521B\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"07B237A9-69A3-4A9C-9DA0-4E06BD37AE73\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/29a07f2ee4d273760c2acbfc756e29eccd82470a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/37ed6f244ec5bda2e90b085084e322ea55d0aaa2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/46134031c20fd313d03b90169d64b2e05ca6b65c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/4b911a9690d72641879ea6d13cce1de31d346d79\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5a4603fbc285752d19e4b415466db18ef3617e4a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/696d18bb59727a2e0526c0802a812620be1c9340\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a7c2c3c1caabcb4a3d6c47284c397507aaf54fe9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/bbccf0caef2fa917d6d0692385a06ce3c262a216\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/29a07f2ee4d273760c2acbfc756e29eccd82470a\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/37ed6f244ec5bda2e90b085084e322ea55d0aaa2\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/46134031c20fd313d03b90169d64b2e05ca6b65c\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/4b911a9690d72641879ea6d13cce1de31d346d79\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5a4603fbc285752d19e4b415466db18ef3617e4a\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/696d18bb59727a2e0526c0802a812620be1c9340\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a7c2c3c1caabcb4a3d6c47284c397507aaf54fe9\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/bbccf0caef2fa917d6d0692385a06ce3c262a216\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2024/06/msg00019.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://security.netapp.com/advisory/ntap-20240912-0006/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/a7c2c3c1caabcb4a3d6c47284c397507aaf54fe9\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/46134031c20fd313d03b90169d64b2e05ca6b65c\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/bbccf0caef2fa917d6d0692385a06ce3c262a216\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/5a4603fbc285752d19e4b415466db18ef3617e4a\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/37ed6f244ec5bda2e90b085084e322ea55d0aaa2\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/696d18bb59727a2e0526c0802a812620be1c9340\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/29a07f2ee4d273760c2acbfc756e29eccd82470a\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/4b911a9690d72641879ea6d13cce1de31d346d79\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2024/06/msg00019.html\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://security.netapp.com/advisory/ntap-20240912-0006/\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-09-12T16:02:59.824Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-36933\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-06-04T15:40:25.095830Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-06-04T15:40:29.025Z\"}}], \"cna\": {\"title\": \"nsh: Restore skb-\u003e{protocol,data,mac_header} for outer header in nsh_gso_segment().\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"c411ed854584\", \"lessThan\": \"a7c2c3c1caab\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"c411ed854584\", \"lessThan\": \"46134031c20f\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"c411ed854584\", \"lessThan\": \"bbccf0caef2f\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"c411ed854584\", \"lessThan\": \"5a4603fbc285\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"c411ed854584\", \"lessThan\": \"37ed6f244ec5\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"c411ed854584\", \"lessThan\": \"696d18bb5972\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"c411ed854584\", \"lessThan\": \"29a07f2ee4d2\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"c411ed854584\", \"lessThan\": \"4b911a9690d7\", \"versionType\": \"git\"}], \"programFiles\": [\"net/nsh/nsh.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.14\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"4.14\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"4.19.314\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.19.*\"}, {\"status\": \"unaffected\", \"version\": \"5.4.276\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.217\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.159\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.91\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.31\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8.10\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.8.*\"}, {\"status\": \"unaffected\", \"version\": \"6.9\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"net/nsh/nsh.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/a7c2c3c1caabcb4a3d6c47284c397507aaf54fe9\"}, {\"url\": \"https://git.kernel.org/stable/c/46134031c20fd313d03b90169d64b2e05ca6b65c\"}, {\"url\": \"https://git.kernel.org/stable/c/bbccf0caef2fa917d6d0692385a06ce3c262a216\"}, {\"url\": \"https://git.kernel.org/stable/c/5a4603fbc285752d19e4b415466db18ef3617e4a\"}, {\"url\": \"https://git.kernel.org/stable/c/37ed6f244ec5bda2e90b085084e322ea55d0aaa2\"}, {\"url\": \"https://git.kernel.org/stable/c/696d18bb59727a2e0526c0802a812620be1c9340\"}, {\"url\": \"https://git.kernel.org/stable/c/29a07f2ee4d273760c2acbfc756e29eccd82470a\"}, {\"url\": \"https://git.kernel.org/stable/c/4b911a9690d72641879ea6d13cce1de31d346d79\"}], \"x_generator\": {\"engine\": \"bippy-9e1c9544281a\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnsh: Restore skb-\u003e{protocol,data,mac_header} for outer header in nsh_gso_segment().\\n\\nsyzbot triggered various splats (see [0] and links) by a crafted GSO\\npacket of VIRTIO_NET_HDR_GSO_UDP layering the following protocols:\\n\\n  ETH_P_8021AD + ETH_P_NSH + ETH_P_IPV6 + IPPROTO_UDP\\n\\nNSH can encapsulate IPv4, IPv6, Ethernet, NSH, and MPLS.  As the inner\\nprotocol can be Ethernet, NSH GSO handler, nsh_gso_segment(), calls\\nskb_mac_gso_segment() to invoke inner protocol GSO handlers.\\n\\nnsh_gso_segment() does the following for the original skb before\\ncalling skb_mac_gso_segment()\\n\\n  1. reset skb-\u003enetwork_header\\n  2. save the original skb-\u003e{mac_heaeder,mac_len} in a local variable\\n  3. pull the NSH header\\n  4. resets skb-\u003emac_header\\n  5. set up skb-\u003emac_len and skb-\u003eprotocol for the inner protocol.\\n\\nand does the following for the segmented skb\\n\\n  6. set ntohs(ETH_P_NSH) to skb-\u003eprotocol\\n  7. push the NSH header\\n  8. restore skb-\u003emac_header\\n  9. set skb-\u003emac_header + mac_len to skb-\u003enetwork_header\\n 10. restore skb-\u003emac_len\\n\\nThere are two problems in 6-7 and 8-9.\\n\\n  (a)\\n  After 6 \u0026 7, skb-\u003edata points to the NSH header, so the outer header\\n  (ETH_P_8021AD in this case) is stripped when skb is sent out of netdev.\\n\\n  Also, if NSH is encapsulated by NSH + Ethernet (so NSH-Ethernet-NSH),\\n  skb_pull() in the first nsh_gso_segment() will make skb-\u003edata point\\n  to the middle of the outer NSH or Ethernet header because the Ethernet\\n  header is not pulled by the second nsh_gso_segment().\\n\\n  (b)\\n  While restoring skb-\u003e{mac_header,network_header} in 8 \u0026 9,\\n  nsh_gso_segment() does not assume that the data in the linear\\n  buffer is shifted.\\n\\n  However, udp6_ufo_fragment() could shift the data and change\\n  skb-\u003emac_header accordingly as demonstrated by syzbot.\\n\\n  If this happens, even the restored skb-\u003emac_header points to\\n  the middle of the outer header.\\n\\nIt seems nsh_gso_segment() has never worked with outer headers so far.\\n\\nAt the end of nsh_gso_segment(), the outer header must be restored for\\nthe segmented skb, instead of the NSH header.\\n\\nTo do that, let\u0027s calculate the outer header position relatively from\\nthe inner header and set skb-\u003e{data,mac_header,protocol} properly.\\n\\n[0]:\\nBUG: KMSAN: uninit-value in ipvlan_process_outbound drivers/net/ipvlan/ipvlan_core.c:524 [inline]\\nBUG: KMSAN: uninit-value in ipvlan_xmit_mode_l3 drivers/net/ipvlan/ipvlan_core.c:602 [inline]\\nBUG: KMSAN: uninit-value in ipvlan_queue_xmit+0xf44/0x16b0 drivers/net/ipvlan/ipvlan_core.c:668\\n ipvlan_process_outbound drivers/net/ipvlan/ipvlan_core.c:524 [inline]\\n ipvlan_xmit_mode_l3 drivers/net/ipvlan/ipvlan_core.c:602 [inline]\\n ipvlan_queue_xmit+0xf44/0x16b0 drivers/net/ipvlan/ipvlan_core.c:668\\n ipvlan_start_xmit+0x5c/0x1a0 drivers/net/ipvlan/ipvlan_main.c:222\\n __netdev_start_xmit include/linux/netdevice.h:4989 [inline]\\n netdev_start_xmit include/linux/netdevice.h:5003 [inline]\\n xmit_one net/core/dev.c:3547 [inline]\\n dev_hard_start_xmit+0x244/0xa10 net/core/dev.c:3563\\n __dev_queue_xmit+0x33ed/0x51c0 net/core/dev.c:4351\\n dev_queue_xmit include/linux/netdevice.h:3171 [inline]\\n packet_xmit+0x9c/0x6b0 net/packet/af_packet.c:276\\n packet_snd net/packet/af_packet.c:3081 [inline]\\n packet_sendmsg+0x8aef/0x9f10 net/packet/af_packet.c:3113\\n sock_sendmsg_nosec net/socket.c:730 [inline]\\n __sock_sendmsg net/socket.c:745 [inline]\\n __sys_sendto+0x735/0xa10 net/socket.c:2191\\n __do_sys_sendto net/socket.c:2203 [inline]\\n __se_sys_sendto net/socket.c:2199 [inline]\\n __x64_sys_sendto+0x125/0x1c0 net/socket.c:2199\\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\\n do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83\\n entry_SYSCALL_64_after_hwframe+0x63/0x6b\\n\\nUninit was created at:\\n slab_post_alloc_hook mm/slub.c:3819 [inline]\\n slab_alloc_node mm/slub.c:3860 [inline]\\n __do_kmalloc_node mm/slub.c:3980 [inline]\\n __kmalloc_node_track_caller+0x705/0x1000 mm/slub.c:4001\\n kmalloc_reserve+0x249/0x4a0 net/core/skbuff.c:582\\n __\\n---truncated---\"}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2024-11-05T09:28:20.690Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-36933\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-11-05T09:28:20.690Z\", \"dateReserved\": \"2024-05-30T15:25:07.071Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-05-30T15:29:23.764Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.