{"id":"DEBIAN-CVE-2024-49949","details":"In the Linux kernel, the following vulnerability has been resolved:  net: avoid potential underflow in qdisc_pkt_len_init() with UFO  After commit 7c6d2ecbda83 (\"net: be more gentle about silly gso requests coming from user\") virtio_net_hdr_to_skb() had sanity check to detect malicious attempts from user space to cook a bad GSO packet.  Then commit cf9acc90c80ec (\"net: virtio_net_hdr_to_skb: count transport header in UFO\") while fixing one issue, allowed user space to cook a GSO packet with the following characteristic :  IPv4 SKB_GSO_UDP, gso_size=3, skb-\u003elen = 28.  When this packet arrives in qdisc_pkt_len_init(), we end up with hdr_len = 28 (IPv4 header + UDP header), matching skb-\u003elen  Then the following sets gso_segs to 0 :  gso_segs = DIV_ROUND_UP(skb-\u003elen - hdr_len,                         shinfo-\u003egso_size);  Then later we set qdisc_skb_cb(skb)-\u003epkt_len to back to zero :/  qdisc_skb_cb(skb)-\u003epkt_len += (gso_segs - 1) * hdr_len;  This leads to the following crash in fq_codel [1]  qdisc_pkt_len_init() is best effort, we only want an estimation of the bytes sent on the wire, not crashing the kernel.  This patch is fixing this particular issue, a following one adds more sanity checks for another potential bug.  [1] [   70.724101] BUG: kernel NULL pointer dereference, address: 0000000000000000 [   70.724561] #PF: supervisor read access in kernel mode [   70.724561] #PF: error_code(0x0000) - not-present page [   70.724561] PGD 10ac61067 P4D 10ac61067 PUD 107ee2067 PMD 0 [   70.724561] Oops: Oops: 0000 [#1] SMP NOPTI [   70.724561] CPU: 11 UID: 0 PID: 2163 Comm: b358537762 Not tainted 6.11.0-virtme #991 [   70.724561] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [   70.724561] RIP: 0010:fq_codel_enqueue (net/sched/sch_fq_codel.c:120 net/sched/sch_fq_codel.c:168 net/sched/sch_fq_codel.c:230) sch_fq_codel [ 70.724561] Code: 24 08 49 c1 e1 06 44 89 7c 24 18 45 31 ed 45 31 c0 31 ff 89 44 24 14 4c 03 8b 90 01 00 00 eb 04 39 ca 73 37 4d 8b 39 83 c7 01 \u003c49\u003e 8b 17 49 89 11 41 8b 57 28 45 8b 5f 34 49 c7 07 00 00 00 00 49 All code ========    0:\t24 08                \tand    $0x8,%al    2:\t49 c1 e1 06          \tshl    $0x6,%r9    6:\t44 89 7c 24 18       \tmov    %r15d,0x18(%rsp)    b:\t45 31 ed             \txor    %r13d,%r13d    e:\t45 31 c0             \txor    %r8d,%r8d   11:\t31 ff                \txor    %edi,%edi   13:\t89 44 24 14          \tmov    %eax,0x14(%rsp)   17:\t4c 03 8b 90 01 00 00 \tadd    0x190(%rbx),%r9   1e:\teb 04                \tjmp    0x24   20:\t39 ca                \tcmp    %ecx,%edx   22:\t73 37                \tjae    0x5b   24:\t4d 8b 39             \tmov    (%r9),%r15   27:\t83 c7 01             \tadd    $0x1,%edi   2a:*\t49 8b 17             \tmov    (%r15),%rdx\t\t\u003c-- trapping instruction   2d:\t49 89 11             \tmov    %rdx,(%r9)   30:\t41 8b 57 28          \tmov    0x28(%r15),%edx   34:\t45 8b 5f 34          \tmov    0x34(%r15),%r11d   38:\t49 c7 07 00 00 00 00 \tmovq   $0x0,(%r15)   3f:\t49                   \trex.WB  Code starting with the faulting instruction ===========================================    0:\t49 8b 17             \tmov    (%r15),%rdx    3:\t49 89 11             \tmov    %rdx,(%r9)    6:\t41 8b 57 28          \tmov    0x28(%r15),%edx    a:\t45 8b 5f 34          \tmov    0x34(%r15),%r11d    e:\t49 c7 07 00 00 00 00 \tmovq   $0x0,(%r15)   15:\t49                   \trex.WB [   70.724561] RSP: 0018:ffff95ae85e6fb90 EFLAGS: 00000202 [   70.724561] RAX: 0000000002000000 RBX: ffff95ae841de000 RCX: 0000000000000000 [   70.724561] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000001 [   70.724561] RBP: ffff95ae85e6fbf8 R08: 0000000000000000 R09: ffff95b710a30000 [   70.724561] R10: 0000000000000000 R11: bdf289445ce31881 R12: ffff95ae85e6fc58 [   70.724561] R13: 0000000000000000 R14: 0000000000000040 R15: 0000000000000000 [   70.724561] FS:  000000002c5c1380(0000) GS:ffff95bd7fcc0000(0000) knlGS:0000000000000000 [   70.724561] CS:  0010 DS: 0000 ES: 0000 C ---truncated---","modified":"2026-09-15T09:03:12.537162643Z","published":"2024-10-21T18:15:16.323Z","upstream":["CVE-2024-49949"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2024-49949"}],"affected":[{"package":{"name":"linux","ecosystem":"Debian:12","purl":"pkg:deb/debian/linux?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.115-1"}]}],"versions":["6.1.106-1","6.1.106-2","6.1.106-3","6.1.112-1","6.1.27-1","6.1.37-1","6.1.38-1","6.1.38-2","6.1.38-2~bpo11+1","6.1.38-3","6.1.38-4","6.1.38-4~bpo11+1","6.1.52-1","6.1.55-1","6.1.55-1~bpo11+1","6.1.64-1","6.1.66-1","6.1.67-1","6.1.69-1","6.1.69-1~bpo11+1","6.1.76-1","6.1.76-1~bpo11+1","6.1.82-1","6.1.85-1","6.1.90-1","6.1.90-1~bpo11+1","6.1.94-1","6.1.94-1~bpo11+1","6.1.98-1","6.1.99-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2024-49949.json"}},{"package":{"name":"linux","ecosystem":"Debian:13","purl":"pkg:deb/debian/linux?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.11.4-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2024-49949.json"}},{"package":{"name":"linux","ecosystem":"Debian:14","purl":"pkg:deb/debian/linux?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.11.4-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2024-49949.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}]}