[{"id":3188745,"web_url":"http://patchwork.ozlabs.org/comment/3188745/","msgid":"<686b5c6a-08e4-ddfd-d2f8-e0478d1df18f@canonical.com>","list_archive_url":null,"date":"2023-09-27T12:23:05","subject":"ACK: [SRU Focal,Jammy,OEM-6.1,Lunar 0/5] CVE-2023-42752","submitter":{"id":1232,"url":"http://patchwork.ozlabs.org/api/people/1232/","name":"Tim Gardner","email":"tim.gardner@canonical.com"},"content":"On 9/26/23 6:40 PM, Thadeu Lima de Souza Cascardo wrote:\n> [Impact]\n> An unprivileged user may use a user/network namespace, setup a device with\n> a very large MTU, trigger an IGMP packet transmission that will lead to a\n> system crash. Local privilege escalation cannot be ruled out.\n> \n> [Test case]\n> A PoC was tested and it worked on 6.1 and 6.2 kernels as they carry the\n> kmalloc_reserve changes that make the PoC attack possible. After the fix,\n> IGMP packets are still being transmitted, but the crash is not seen anymore.\n> \n> On 5.15 and 5.4 kernels, the test was still done, even though there is no crash\n> without the fix. But after the fix, IGMP packets are still being transmitted.\n> \n> [Potential regression]\n> On Focal and Jammy, IGMP may be broken. On OEM-6.1 and Lunar, other network\n> workload may be broken as this touches SKB allocation.\n> \n> Eric Dumazet (5):\n> igmp: limit igmpv3_newpack() packet size to IP_MAX_MTU\n> net: add SKB_HEAD_ALIGN() helper\n> net: remove osize variable in __alloc_skb()\n> net: factorize code in kmalloc_reserve()\n> net: deal with integer overflows in kmalloc_reserve()\n> \n> include/linux/skbuff.h | 8 +++++++\n> net/core/skbuff.c | 49 ++++++++++++++++++------------------------\n> net/ipv4/igmp.c | 3 ++-\n> 3 files changed, 31 insertions(+), 29 deletions(-)\n> \nAcked-by: Tim Gardner ","headers":{"Return-Path":"","X-Original-To":"incoming@patchwork.ozlabs.org","Delivered-To":"patchwork-incoming@legolas.ozlabs.org","Authentication-Results":"legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=lists.ubuntu.com\n (client-ip=185.125.189.65; helo=lists.ubuntu.com;\n envelope-from=kernel-team-bounces@lists.ubuntu.com;\n receiver=patchwork.ozlabs.org)","Received":["from lists.ubuntu.com (lists.ubuntu.com [185.125.189.65])\n\t(using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits))\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4RwbPB65Cyz1ypJ\n\tfor ; Wed, 27 Sep 2023 22:23:26 +1000 (AEST)","from localhost ([127.0.0.1] helo=lists.ubuntu.com)\n\tby lists.ubuntu.com with esmtp (Exim 4.86_2)\n\t(envelope-from )\n\tid 1qlTZR-00059J-Ku; Wed, 27 Sep 2023 12:23:13 +0000","from smtp-relay-internal-0.internal ([10.131.114.225]\n helo=smtp-relay-internal-0.canonical.com)\n by lists.ubuntu.com with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128)\n (Exim 4.86_2) (envelope-from )\n id 1qlTZN-000564-2D\n for kernel-team@lists.ubuntu.com; Wed, 27 Sep 2023 12:23:09 +0000","from mail-pf1-f199.google.com (mail-pf1-f199.google.com\n [209.85.210.199])\n (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest\n SHA256)\n (No client certificate requested)\n by smtp-relay-internal-0.canonical.com (Postfix) with ESMTPS id D7D213F675\n for ; Wed, 27 Sep 2023 12:23:08 +0000 (UTC)","by mail-pf1-f199.google.com with SMTP id\n d2e1a72fcca58-690c0539021so16364579b3a.0\n for ; Wed, 27 Sep 2023 05:23:08 -0700 (PDT)","from [192.168.1.4] (174-045-099-030.res.spectrum.com.\n [174.45.99.30])\n by smtp.gmail.com with ESMTPSA id\n lt23-20020a17090b355700b00276a4e67659sm13489825pjb.43.2023.09.27.05.23.06\n (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128);\n Wed, 27 Sep 2023 05:23:06 -0700 (PDT)"],"X-Google-DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed;\n d=1e100.net; s=20230601; t=1695817387; x=1696422187;\n h=content-transfer-encoding:in-reply-to:from:references:to\n :content-language:subject:user-agent:mime-version:date:message-id\n :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;\n bh=JtITCo0n1w0dCfXlWLLZykccnBAv5xoLoCX/LnvdnZA=;\n b=WDBjNSRLeLYAVK8jMuhxb9nwl03+fSF9zUTCJJxR9XMJOcQx4L6Ra8vy9795rWmKEc\n a5/Va7d7tpmYtygHaS0rt0gxpBdjTtbpmCW6hbA+u5Ey5XVYuAz5BXBk2cm7ye8wYHIz\n ugLuYZtjyhfM17GmaccpjwHfmjWtfIWLCWUrBba1o5BiFYPzcxfASu161YcO1vi1OziI\n BkPq5gjL5Fqo4YpsejfltZHGH4SEE+Hk/8V/tFQaHzJr9MeadT5Vmg5Mt3DGeaA7TQdn\n YyGu//rJDZUKgttfyVaK9KpKsWStoaEreVyWCwUqxFxUw2sIDdY8Uo/1/aOLhBl6t/UC\n cQqw==","X-Gm-Message-State":"AOJu0YwCPNhywQwbAzgejDM/xrawwnbARZAHS1enKOdbIsX/lRiwVk9B\n +8We/Dz8aVCPCEjyD26lPoJRJj6Gi/Ku/7Wyxbihc2AdPdAmQBo5Lq+yfWDfuDaWWlwBqZOu1Ko\n voptCKmK3DzDxtIkF63mZxyC/GJLhhA8Ni2//Qud/0K0P7UoIHg==","X-Received":["by 2002:a05:6a20:7f90:b0:154:6480:8588 with SMTP id\n d16-20020a056a207f9000b0015464808588mr2199570pzj.0.1695817387063;\n Wed, 27 Sep 2023 05:23:07 -0700 (PDT)","by 2002:a05:6a20:7f90:b0:154:6480:8588 with SMTP id\n d16-20020a056a207f9000b0015464808588mr2199560pzj.0.1695817386738;\n Wed, 27 Sep 2023 05:23:06 -0700 (PDT)"],"X-Google-Smtp-Source":"\n AGHT+IE8WxaHrpOR7Yf1NL3WlZ3Ro/vuwj9BVZxYw4Kz1WF8gCV61F5MwN/DYOmMsL9XoKbC1sY9SA==","Message-ID":"<686b5c6a-08e4-ddfd-d2f8-e0478d1df18f@canonical.com>","Date":"Wed, 27 Sep 2023 06:23:05 -0600","MIME-Version":"1.0","User-Agent":"Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101\n Thunderbird/102.15.1","Subject":"ACK: [SRU Focal,Jammy,OEM-6.1,Lunar 0/5] CVE-2023-42752","Content-Language":"en-US","To":"Thadeu Lima de Souza Cascardo ,\n kernel-team@lists.ubuntu.com","References":"<20230927004025.119111-1-cascardo@canonical.com>","From":"Tim Gardner ","In-Reply-To":"<20230927004025.119111-1-cascardo@canonical.com>","X-BeenThere":"kernel-team@lists.ubuntu.com","X-Mailman-Version":"2.1.20","Precedence":"list","List-Id":"Kernel team discussions ","List-Unsubscribe":",\n ","List-Archive":"","List-Post":"","List-Help":"","List-Subscribe":",\n ","Content-Transfer-Encoding":"base64","Content-Type":"text/plain; charset=\"utf-8\"; Format=\"flowed\"","Errors-To":"kernel-team-bounces@lists.ubuntu.com","Sender":"\"kernel-team\" "}},{"id":3189260,"web_url":"http://patchwork.ozlabs.org/comment/3189260/","msgid":"","list_archive_url":null,"date":"2023-09-28T08:12:15","subject":"ACK: [SRU Focal,Jammy,OEM-6.1,Lunar 0/5] CVE-2023-42752","submitter":{"id":85750,"url":"http://patchwork.ozlabs.org/api/people/85750/","name":"Roxana Nicolescu","email":"roxana.nicolescu@canonical.com"},"content":"On 27/09/2023 02:40, Thadeu Lima de Souza Cascardo wrote:\n> [Impact]\n> An unprivileged user may use a user/network namespace, setup a device with\n> a very large MTU, trigger an IGMP packet transmission that will lead to a\n> system crash. Local privilege escalation cannot be ruled out.\n>\n> [Test case]\n> A PoC was tested and it worked on 6.1 and 6.2 kernels as they carry the\n> kmalloc_reserve changes that make the PoC attack possible. After the fix,\n> IGMP packets are still being transmitted, but the crash is not seen anymore.\n>\n> On 5.15 and 5.4 kernels, the test was still done, even though there is no crash\n> without the fix. But after the fix, IGMP packets are still being transmitted.\n>\n> [Potential regression]\n> On Focal and Jammy, IGMP may be broken. On OEM-6.1 and Lunar, other network\n> workload may be broken as this touches SKB allocation.\n>\n> Eric Dumazet (5):\n> igmp: limit igmpv3_newpack() packet size to IP_MAX_MTU\n> net: add SKB_HEAD_ALIGN() helper\n> net: remove osize variable in __alloc_skb()\n> net: factorize code in kmalloc_reserve()\n> net: deal with integer overflows in kmalloc_reserve()\n>\n> include/linux/skbuff.h | 8 +++++++\n> net/core/skbuff.c | 49 ++++++++++++++++++------------------------\n> net/ipv4/igmp.c | 3 ++-\n> 3 files changed, 31 insertions(+), 29 deletions(-)\n>\nAcked-by: Roxana Nicolescu ","headers":{"Return-Path":"","X-Original-To":"incoming@patchwork.ozlabs.org","Delivered-To":"patchwork-incoming@legolas.ozlabs.org","Authentication-Results":"legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=lists.ubuntu.com\n (client-ip=185.125.189.65; helo=lists.ubuntu.com;\n envelope-from=kernel-team-bounces@lists.ubuntu.com;\n receiver=patchwork.ozlabs.org)","Received":["from lists.ubuntu.com (lists.ubuntu.com [185.125.189.65])\n\t(using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits))\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4Rx5nW3PFpz1ynm\n\tfor ; Thu, 28 Sep 2023 18:12:47 +1000 (AEST)","from localhost ([127.0.0.1] helo=lists.ubuntu.com)\n\tby lists.ubuntu.com with esmtp (Exim 4.86_2)\n\t(envelope-from )\n\tid 1qlm8K-0007fF-6x; Thu, 28 Sep 2023 08:12:28 +0000","from smtp-relay-internal-0.internal ([10.131.114.225]\n helo=smtp-relay-internal-0.canonical.com)\n by lists.ubuntu.com with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128)\n (Exim 4.86_2) (envelope-from )\n id 1qlm8E-0007eg-SE\n for kernel-team@lists.ubuntu.com; Thu, 28 Sep 2023 08:12:24 +0000","from mail-io1-f71.google.com (mail-io1-f71.google.com\n [209.85.166.71])\n (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest\n SHA256)\n (No client certificate requested)\n by smtp-relay-internal-0.canonical.com (Postfix) with ESMTPS id 15B8E3F42A\n for ; Thu, 28 Sep 2023 08:12:22 +0000 (UTC)","by mail-io1-f71.google.com with SMTP id\n ca18e2360f4ac-786d9d4d9a6so1643361439f.2\n for ; Thu, 28 Sep 2023 01:12:22 -0700 (PDT)","from ?IPV6:2001:67c:1560:8007::aac:c490?\n ([2001:67c:1560:8007::aac:c490]) by smtp.gmail.com with ESMTPSA id\n x10-20020a63b34a000000b0056946623d7esm10857291pgt.55.2023.09.28.01.12.18\n for \n (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128);\n Thu, 28 Sep 2023 01:12:19 -0700 (PDT)"],"X-Google-DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed;\n d=1e100.net; s=20230601; t=1695888741; x=1696493541;\n h=content-transfer-encoding:in-reply-to:autocrypt:from\n :content-language:references:to:subject:user-agent:mime-version:date\n :message-id:x-gm-message-state:from:to:cc:subject:date:message-id\n :reply-to;\n bh=wbXinBO7xZoZV9descSRF1RdLyhENiZPbC/sKZ+vStw=;\n b=L4MttuhfKRTRZBrQcHJXlLNLskQeRM9LhLk/ehP7INjUDGWdy81UPxm4dB1JyCwNbm\n U4OfZcXX7/jmpu3aD6VO4tOkeVmid+OZ+Jvv8Wuk7isleq0Vd1NzHG+J3EOivMz+MJIE\n dSjzffJJVPmjhff9tcTSi97iU9RdesISMNI9D5Vx26mKHPwwIbbv/6Wtylj1FyWKUBw/\n mXvwX0U9gQVuxpBvqPdz6YZUEMeazWuJ/gXaAt/z/2jW5zhWAzguDx6I3EZuS6WV6jS5\n VVOv21rWoDxV130r0wUispAUz0DhCrus/3d5lrMzj8IUMx+q21DAh6QlwtlFidkH/xEX\n YCUQ==","X-Gm-Message-State":"AOJu0Yx8VPg8elpXuUY665HnmuZzJ5Hblm+BSAlUhF88UVID/5ytXmTA\n 2o3b8pFWUSr0/kJ5ZycdCwK9tJ+g+gD5KYgsoRPM3k6mdfRdxIiw4Jj3w4FCK5Wn34wnJDCnWo8\n yU1WOy1mTdCKTAXcJ9L8ORHo2oth5dLBx5E7j7inGhYHVTj3VTHayFbc=","X-Received":["by 2002:a05:6e02:1c07:b0:34f:6f44:aec4 with SMTP id\n l7-20020a056e021c0700b0034f6f44aec4mr660434ilh.8.1695888740943;\n Thu, 28 Sep 2023 01:12:20 -0700 (PDT)","by 2002:a05:6e02:1c07:b0:34f:6f44:aec4 with SMTP id\n l7-20020a056e021c0700b0034f6f44aec4mr660425ilh.8.1695888740656;\n Thu, 28 Sep 2023 01:12:20 -0700 (PDT)"],"X-Google-Smtp-Source":"\n AGHT+IEEGuLpbR5CIzJjvJ/NaRUuoIrKIalYfrJuMruccp3apJaZU3T7/Rrw6rbfFdMUvcBTVco6Mw==","Message-ID":"","Date":"Thu, 28 Sep 2023 10:12:15 +0200","MIME-Version":"1.0","User-Agent":"Mozilla Thunderbird","Subject":"ACK: [SRU Focal,Jammy,OEM-6.1,Lunar 0/5] CVE-2023-42752","To":"kernel-team@lists.ubuntu.com","References":"<20230927004025.119111-1-cascardo@canonical.com>","Content-Language":"en-US","From":"Roxana Nicolescu ","Autocrypt":"addr=roxana.nicolescu@canonical.com; keydata=\n xsFNBGOz8dUBEACbW6iR0smNW8BxmNcHzzktKmKImDxMdQlHZDYbKfQLBwNPGXaBq9b8vq2h\n Ae9pdbwIvaHmx2dL1hWuD1X1S7CKxqH9lsZXF2FZk/l1wlHSRIsElTaxau5lZP+EwzES2kXM\n 9zSRE+R6bD/MkGbwPl5fkRY0yhgLt2pEuc+yBLHVkENpr+cC3saikSRwtI6jfApHv2C9DKlq\n +42n0urEI7WR4l0Gdvw/t9c9B3QeEigxz5u1OicnhKcG4GK9gwmCYP2wbjPVwHr1zAxMxHAY\n sKSmR2jb32N+3QnyoLvvQekk8wG0ainqv332+vvxYeTDXTrohdSg5OZPON1V7Wh3LPLAlQbe\n agI0g+lCRXriv7Lu33tLlL7a2ph3bUEMAvagI4rhsgg7NSg4uzeOeLDAdW42qHQGDyRxX0Lw\n U8ZXuN551KLm0u2I/Ruo2AUFIavkjUfSsXqHJpCY2CXmvjDeHcBsHlN7U8VqNeYsqXn0EnjN\n OqgW94WWDZTS8ZFM8kkYbA2d7DQZstmhS9h/zJ3Y3wdsph4BDebp5yMH3vXnwOh85ijqQXM7\n iUkjIfjpXCejDOaeb9RT4xzwEmxChhGYqBk5mNr/plSyyLD+OkOLzAMeFmh5sx5x+/Oui/Xn\n s97hNlfOKOT42WLkcXcRF8xGborT79Nv5ird9E8qDwpkFT3gwwARAQABzTFSb3hhbmEgTmlj\n b2xlc2N1IDxyb3hhbmEubmljb2xlc2N1QGNhbm9uaWNhbC5jb20+wsGOBBMBCgA4FiEEuTxl\n ymcAhyYitf9DENoe7adEB28FAmOz8dUCGwMFCwkIBwIGFQoJCAsCBBYCAwECHgECF4AACgkQ\n ENoe7adEB29U0w/+KR8ikSBennP/B26R8KhFVFUAJCxBToGdHWWoNzmSBMijTvrz4pSS3OfI\n F8fOFPel0aQqoZOOgqC9rWPMy++o20qSg2pUCRrPvqK1YteIX1PTRfoxRSYP5NPp0uQz8f5w\n BKvXSb6eu8JHNzlFlKCvOt5EeMICsl47qf8vGh2/t3PRsp9aLOed1fXnNUXNxqCLphcRwGy5\n sGezEFK690x6oJHmTkq0r4jCCaJpDvUwx4VAAL1SsaEjRwgyN9O3Hp78KlJq+wdfjtMrtheY\n AnME9B0OjuE/PeScNy4qG/jmmjTmlkT4n99JkkQXTiJeiWZSkBAh/1zR/j59q5GiyTOCEIFw\n IZJNIBTdfHfwEYoPiRiaZk3zCVGgey+F7trwXXM0AY4IoBwvpB671RFxsrrbS/Pz7i1WgtW6\n oSK+u6OqmewRqZAqg+vYCzflxfFk6xKiAuKtLiZED3e2Lt0aHFCKyCDpsdMsTDSupO8WnqvB\n 4yJkoO6QyzyGT2Rv5eWI8S3/R7MTtJMt/K+fYJ8+/ltlHqKIcmpFrByft779g3D5dyKtRfWV\n s1FMHwoAdr7xEc8avcVbqTXSurFcnwMCYuM6G9zCB+q2yaKGhMzPA/LHlbGyS8QpO5H3ksp+\n bx/87wRw/0ScbT/eswhg53tZx//Gxf5zIMcPDytp/vwcyk1HWiDOwU0EY7Px1QEQALRjXzH1\n KoYC1+9B2+/s7EQWx5lfXimqnVG+qPl01q9qEPZqrjBwXOWJhLaFYLFa3GWOVxSpzRpZNL64\n wwmABJWQEWqDoW4p37q51TxjcQbs/P8jIy0tvDzYixWUj/NwBJnIuI5ge+GJ9xBtsN+e6/34\n pXs+hOAU2d9HPmpmU4WnRNqIfckBABZK5wB19Xhljo7usXKRciuJkTLp2rQDcmpxBv+VqqKW\n icFmW4iam6ZHuElU56/Li/U51L1LeMOCtXWnrKKoiaRSBK1XiItij1mYs6ayaBlxXk8xceeH\n bAHMgZXnltNJeog4S/1doGnrlJYkYcYdDu+Fzf+c5A5bFbe/s89uSpst3kbEqAD1AFEDBfgK\n Kc7CiI3L0uQJ0oYFRMMeu2FM1GMYFF24VZi72fI9WPpU0HmXF0ZouIcud2fcCVmG0S9euif0\n abPi/1Fhn4zIl7bG2+TeBeS28RYZA7XC4exbiPOPRETbFBsTWp8KloRNdIQGg3FCudMz2LKv\n UOu/IXafwBtgORLDr1dj2Ze2Krf4EkBJh8xRgCYbvBOycceyIkBb+F3IfDxqvmaDqnEnoJyS\n lZ84o8R3V3lhP2OD/Yvb+gBl+O/xXzfP6rRMrruZRFof3AXsuKKOcgDpIXd2/MsG/MK/HTHK\n 6KFfZCGUdTxhoAr3XVg8Q0CuwZ3jABEBAAHCwXYEGAEKACAWIQS5PGXKZwCHJiK1/0MQ2h7t\n p0QHbwUCY7Px1QIbDAAKCRAQ2h7tp0QHb9HKD/42ya1pLxmkJ7pAZeWIiszMwDEEmxbQicS9\n fZtjRN/IL3AiVvcWyN8cqsESx9xzCnjad+rCHr4PmuGvTHasolFHziCX5B2bCRAVAkGIBcJC\n 2mCPQEGZt8YysGS/y9KxqMgCy045pcBKtmPtRWab26+3FbkjJ/eje9vcDv2GyN09Rh6R57Zx\n 2hN4rZjZnbp7vfZPrKhPbIT2ckV5ZtUm9Er0/Vy/Lu/CrnOOYwJrpgLa8R3thBR9t0pDZdFd\n VAwl12qzt2C9Js+XjuxhYuywTtpvr8QgBhu4U/JN7OFfxD5WSanJ38KSFK3FeUdeqIfDDTQK\n d0f6ntHmjLqteo87cedJGwtFIZTW1a5eCZiKsfhosCSmrFw3DLDI5Cun7Sm1SWMShYzSpnSC\n i75PB8GYiH5T12ZSxRhRXCIri0OzPRYvfKZ82Ji33UUG5MZvqKpttEXaK8bxqmAg0TrJ+nLd\n jn99r9WDQokRITZRW4GCUDFY/K6p8MBfGM+sm3oi50hGXi4SRIYD0dZpC7QWRYNmhR9AsxWR\n EGoQV+X6XMEh1XFcBpExwvFrIpD+5SZrWp4e/lGLGA70EBHKFO15YL1Pv+fChskp3wRYr4mG\n Ao8E1tCv1TJZdkVZ7z93qUroOf8qi71FSzApqEHX7OyT3ad5/fYRzeme+3VlwGS6MHMWnpuo Og==","In-Reply-To":"<20230927004025.119111-1-cascardo@canonical.com>","X-BeenThere":"kernel-team@lists.ubuntu.com","X-Mailman-Version":"2.1.20","Precedence":"list","List-Id":"Kernel team discussions ","List-Unsubscribe":",\n ","List-Archive":"","List-Post":"","List-Help":"","List-Subscribe":",\n ","Content-Transfer-Encoding":"base64","Content-Type":"text/plain; charset=\"utf-8\"; Format=\"flowed\"","Errors-To":"kernel-team-bounces@lists.ubuntu.com","Sender":"\"kernel-team\" "}},{"id":3189368,"web_url":"http://patchwork.ozlabs.org/comment/3189368/","msgid":"<6758f881-0be7-07df-11b7-2eca00b1bb40@ubuntu.com>","list_archive_url":null,"date":"2023-09-28T11:47:28","subject":"APPLIED [OEM-6.1] Re: [SRU Focal,Jammy,OEM-6.1,Lunar 0/5]\n CVE-2023-42752","submitter":{"id":10238,"url":"http://patchwork.ozlabs.org/api/people/10238/","name":"Timo Aaltonen","email":"tjaalton@ubuntu.com"},"content":"Thadeu Lima de Souza Cascardo kirjoitti 27.9.2023 klo 3.40:\n> [Impact]\n> An unprivileged user may use a user/network namespace, setup a device with\n> a very large MTU, trigger an IGMP packet transmission that will lead to a\n> system crash. Local privilege escalation cannot be ruled out.\n> \n> [Test case]\n> A PoC was tested and it worked on 6.1 and 6.2 kernels as they carry the\n> kmalloc_reserve changes that make the PoC attack possible. After the fix,\n> IGMP packets are still being transmitted, but the crash is not seen anymore.\n> \n> On 5.15 and 5.4 kernels, the test was still done, even though there is no crash\n> without the fix. But after the fix, IGMP packets are still being transmitted.\n> \n> [Potential regression]\n> On Focal and Jammy, IGMP may be broken. On OEM-6.1 and Lunar, other network\n> workload may be broken as this touches SKB allocation.\n> \n> Eric Dumazet (5):\n> igmp: limit igmpv3_newpack() packet size to IP_MAX_MTU\n> net: add SKB_HEAD_ALIGN() helper\n> net: remove osize variable in __alloc_skb()\n> net: factorize code in kmalloc_reserve()\n> net: deal with integer overflows in kmalloc_reserve()\n> \n> include/linux/skbuff.h | 8 +++++++\n> net/core/skbuff.c | 49 ++++++++++++++++++------------------------\n> net/ipv4/igmp.c | 3 ++-\n> 3 files changed, 31 insertions(+), 29 deletions(-)\n> \n\napplied to oem-6.1, thanks","headers":{"Return-Path":"","X-Original-To":"incoming@patchwork.ozlabs.org","Delivered-To":"patchwork-incoming@legolas.ozlabs.org","Authentication-Results":"legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=lists.ubuntu.com\n (client-ip=185.125.189.65; helo=lists.ubuntu.com;\n envelope-from=kernel-team-bounces@lists.ubuntu.com;\n receiver=patchwork.ozlabs.org)","Received":["from lists.ubuntu.com (lists.ubuntu.com [185.125.189.65])\n\t(using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits))\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4RxBZB3J38z1ynX\n\tfor ; Thu, 28 Sep 2023 21:48:17 +1000 (AEST)","from localhost ([127.0.0.1] helo=lists.ubuntu.com)\n\tby lists.ubuntu.com with esmtp (Exim 4.86_2)\n\t(envelope-from )\n\tid 1qlpUk-0001Md-NQ; Thu, 28 Sep 2023 11:47:54 +0000","from smtp-relay-canonical-0.internal ([10.131.114.83]\n helo=smtp-relay-canonical-0.canonical.com)\n by lists.ubuntu.com with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128)\n (Exim 4.86_2) (envelope-from )\n id 1qlpUP-0001Fy-GZ\n for kernel-team@lists.ubuntu.com; Thu, 28 Sep 2023 11:47:34 +0000","from [10.172.193.56] (1.general.tjaalton.uk.vpn [10.172.193.56])\n (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n key-exchange X25519 server-signature RSA-PSS (2048 bits))\n (No client certificate requested)\n by smtp-relay-canonical-0.canonical.com (Postfix) with ESMTPSA id 20BE33F201;\n Thu, 28 Sep 2023 11:47:29 +0000 (UTC)"],"Message-ID":"<6758f881-0be7-07df-11b7-2eca00b1bb40@ubuntu.com>","Date":"Thu, 28 Sep 2023 14:47:28 +0300","MIME-Version":"1.0","User-Agent":"Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101\n Thunderbird/102.15.1","Subject":"APPLIED [OEM-6.1] Re: [SRU Focal,Jammy,OEM-6.1,Lunar 0/5]\n CVE-2023-42752","Content-Language":"en-US","To":"Thadeu Lima de Souza Cascardo ,\n kernel-team@lists.ubuntu.com","References":"<20230927004025.119111-1-cascardo@canonical.com>","From":"Timo Aaltonen ","In-Reply-To":"<20230927004025.119111-1-cascardo@canonical.com>","X-BeenThere":"kernel-team@lists.ubuntu.com","X-Mailman-Version":"2.1.20","Precedence":"list","List-Id":"Kernel team discussions ","List-Unsubscribe":",\n ","List-Archive":"","List-Post":"","List-Help":"","List-Subscribe":",\n ","Content-Transfer-Encoding":"base64","Content-Type":"text/plain; charset=\"utf-8\"; Format=\"flowed\"","Errors-To":"kernel-team-bounces@lists.ubuntu.com","Sender":"\"kernel-team\" "}},{"id":3189897,"web_url":"http://patchwork.ozlabs.org/comment/3189897/","msgid":"<76da18ba-9fa5-4469-a831-da1d887d30b8@canonical.com>","list_archive_url":null,"date":"2023-09-29T06:53:48","subject":"APPLIED[F,J,L]]: [SRU Focal,Jammy,OEM-6.1,Lunar 0/5] CVE-2023-42752","submitter":{"id":85750,"url":"http://patchwork.ozlabs.org/api/people/85750/","name":"Roxana Nicolescu","email":"roxana.nicolescu@canonical.com"},"content":"On 27/09/2023 02:40, Thadeu Lima de Souza Cascardo wrote:\n> [Impact]\n> An unprivileged user may use a user/network namespace, setup a device with\n> a very large MTU, trigger an IGMP packet transmission that will lead to a\n> system crash. Local privilege escalation cannot be ruled out.\n>\n> [Test case]\n> A PoC was tested and it worked on 6.1 and 6.2 kernels as they carry the\n> kmalloc_reserve changes that make the PoC attack possible. After the fix,\n> IGMP packets are still being transmitted, but the crash is not seen anymore.\n>\n> On 5.15 and 5.4 kernels, the test was still done, even though there is no crash\n> without the fix. But after the fix, IGMP packets are still being transmitted.\n>\n> [Potential regression]\n> On Focal and Jammy, IGMP may be broken. On OEM-6.1 and Lunar, other network\n> workload may be broken as this touches SKB allocation.\n>\n> Eric Dumazet (5):\n> igmp: limit igmpv3_newpack() packet size to IP_MAX_MTU\n> net: add SKB_HEAD_ALIGN() helper\n> net: remove osize variable in __alloc_skb()\n> net: factorize code in kmalloc_reserve()\n> net: deal with integer overflows in kmalloc_reserve()\n>\n> include/linux/skbuff.h | 8 +++++++\n> net/core/skbuff.c | 49 ++++++++++++++++++------------------------\n> net/ipv4/igmp.c | 3 ++-\n> 3 files changed, 31 insertions(+), 29 deletions(-)\n>\nApplied to focal,jammy,lunar:master-next. Thanks!\n\nRoxana","headers":{"Return-Path":"","X-Original-To":"incoming@patchwork.ozlabs.org","Delivered-To":"patchwork-incoming@legolas.ozlabs.org","Authentication-Results":"legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=lists.ubuntu.com\n (client-ip=185.125.189.65; helo=lists.ubuntu.com;\n envelope-from=kernel-team-bounces@lists.ubuntu.com;\n receiver=patchwork.ozlabs.org)","Received":["from lists.ubuntu.com (lists.ubuntu.com [185.125.189.65])\n\t(using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits))\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4Rxh0l0jWwz1ynm\n\tfor ; Fri, 29 Sep 2023 16:54:30 +1000 (AEST)","from localhost ([127.0.0.1] helo=lists.ubuntu.com)\n\tby lists.ubuntu.com with esmtp (Exim 4.86_2)\n\t(envelope-from )\n\tid 1qm7O5-0001wF-HC; Fri, 29 Sep 2023 06:54:10 +0000","from smtp-relay-internal-0.internal ([10.131.114.225]\n helo=smtp-relay-internal-0.canonical.com)\n by lists.ubuntu.com with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128)\n (Exim 4.86_2) (envelope-from )\n id 1qm7Nm-0001sJ-4h\n for kernel-team@lists.ubuntu.com; Fri, 29 Sep 2023 06:53:50 +0000","from mail-ej1-f70.google.com (mail-ej1-f70.google.com\n [209.85.218.70])\n (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest\n SHA256)\n (No client certificate requested)\n by smtp-relay-internal-0.canonical.com (Postfix) with ESMTPS id CD99A3F680\n for ; Fri, 29 Sep 2023 06:53:49 +0000 (UTC)","by mail-ej1-f70.google.com with SMTP id\n a640c23a62f3a-9ae7663e604so1024799766b.3\n for ; Thu, 28 Sep 2023 23:53:49 -0700 (PDT)","from [192.168.0.189] (77-169-125-32.fixed.kpn.net. [77.169.125.32])\n by smtp.gmail.com with ESMTPSA id\n my8-20020a1709065a4800b009b296ce13a3sm5609327ejc.18.2023.09.28.23.53.48\n for \n (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128);\n Thu, 28 Sep 2023 23:53:48 -0700 (PDT)"],"X-Google-DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed;\n d=1e100.net; s=20230601; t=1695970429; x=1696575229;\n h=content-transfer-encoding:in-reply-to:autocrypt:from:references:to\n :content-language:subject:user-agent:mime-version:date:message-id\n :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;\n bh=kBoZokg+kFdsOeI/QHJ1DPYGKCRNOZlxcFvGz0Fw1/c=;\n b=FdkM35O05IZITPAfjvt1+eggW2OW3UadImcpSzBUC0pEJbW3B7paO49wdebemC9tY6\n xLInF82aaoBUx72qHB6fObjfqw9k8UaJf38aW1E0vEY/rNChI33B0SwHq9ZYOKvi+ovP\n d91esZH0X25kWLsyh04pu1dkxTK62pz6QiOj1KUATweeLBs9B0sSKyT+/hKfR2V5oj8Y\n pZme5KH5HUXS0ZmON/hGTUzDOC6wXOn8R2fkGT/T/DWhAHG0oXLRb+m4KCQowGqziySH\n IkgkAc+NtAXJofrM8LXYbwn9Jbz6+rG9B7qgxe2Xe1LAwQpkVehov8PeDpG2oAhNOmIa\n GZDg==","X-Gm-Message-State":"AOJu0YzowXUvLAMYp7O8AAKVV/Gkle7u3/iRznzUcEPtxQnA9V8Dloqc\n Zndclx6XFTbbntTWmkBFxlmCPM4sZHEpeoBU6HfYGsSxd4NUQZG9mReHeO4YaKQSaz1QeULYv9T\n AVzV+2YAo+BUn9zBdKb/ahjPOc+ML31ipAdM439IOr6lBfq9wL1S8E8Y=","X-Received":["by 2002:a17:907:2cf6:b0:9a5:c3fe:a4ef with SMTP id\n hz22-20020a1709072cf600b009a5c3fea4efmr3013620ejc.29.1695970429529;\n Thu, 28 Sep 2023 23:53:49 -0700 (PDT)","by 2002:a17:907:2cf6:b0:9a5:c3fe:a4ef with SMTP id\n hz22-20020a1709072cf600b009a5c3fea4efmr3013612ejc.29.1695970429139;\n Thu, 28 Sep 2023 23:53:49 -0700 (PDT)"],"X-Google-Smtp-Source":"\n AGHT+IGudoHiPhzqHztjiiv8Mjdby8DqoBnOch/2cWJGHg0oGc1WsexWpp/86/EuOD40cuvlMKfOZQ==","Message-ID":"<76da18ba-9fa5-4469-a831-da1d887d30b8@canonical.com>","Date":"Fri, 29 Sep 2023 08:53:48 +0200","MIME-Version":"1.0","User-Agent":"Mozilla Thunderbird","Subject":"APPLIED[F,J,L]]: [SRU Focal,Jammy,OEM-6.1,Lunar 0/5] CVE-2023-42752","Content-Language":"en-US","To":"kernel-team@lists.ubuntu.com","References":"<20230927004025.119111-1-cascardo@canonical.com>","From":"Roxana Nicolescu ","Autocrypt":"addr=roxana.nicolescu@canonical.com; keydata=\n xsFNBGOz8dUBEACbW6iR0smNW8BxmNcHzzktKmKImDxMdQlHZDYbKfQLBwNPGXaBq9b8vq2h\n Ae9pdbwIvaHmx2dL1hWuD1X1S7CKxqH9lsZXF2FZk/l1wlHSRIsElTaxau5lZP+EwzES2kXM\n 9zSRE+R6bD/MkGbwPl5fkRY0yhgLt2pEuc+yBLHVkENpr+cC3saikSRwtI6jfApHv2C9DKlq\n +42n0urEI7WR4l0Gdvw/t9c9B3QeEigxz5u1OicnhKcG4GK9gwmCYP2wbjPVwHr1zAxMxHAY\n sKSmR2jb32N+3QnyoLvvQekk8wG0ainqv332+vvxYeTDXTrohdSg5OZPON1V7Wh3LPLAlQbe\n agI0g+lCRXriv7Lu33tLlL7a2ph3bUEMAvagI4rhsgg7NSg4uzeOeLDAdW42qHQGDyRxX0Lw\n U8ZXuN551KLm0u2I/Ruo2AUFIavkjUfSsXqHJpCY2CXmvjDeHcBsHlN7U8VqNeYsqXn0EnjN\n OqgW94WWDZTS8ZFM8kkYbA2d7DQZstmhS9h/zJ3Y3wdsph4BDebp5yMH3vXnwOh85ijqQXM7\n iUkjIfjpXCejDOaeb9RT4xzwEmxChhGYqBk5mNr/plSyyLD+OkOLzAMeFmh5sx5x+/Oui/Xn\n s97hNlfOKOT42WLkcXcRF8xGborT79Nv5ird9E8qDwpkFT3gwwARAQABzTFSb3hhbmEgTmlj\n b2xlc2N1IDxyb3hhbmEubmljb2xlc2N1QGNhbm9uaWNhbC5jb20+wsGOBBMBCgA4FiEEuTxl\n ymcAhyYitf9DENoe7adEB28FAmOz8dUCGwMFCwkIBwIGFQoJCAsCBBYCAwECHgECF4AACgkQ\n ENoe7adEB29U0w/+KR8ikSBennP/B26R8KhFVFUAJCxBToGdHWWoNzmSBMijTvrz4pSS3OfI\n F8fOFPel0aQqoZOOgqC9rWPMy++o20qSg2pUCRrPvqK1YteIX1PTRfoxRSYP5NPp0uQz8f5w\n BKvXSb6eu8JHNzlFlKCvOt5EeMICsl47qf8vGh2/t3PRsp9aLOed1fXnNUXNxqCLphcRwGy5\n sGezEFK690x6oJHmTkq0r4jCCaJpDvUwx4VAAL1SsaEjRwgyN9O3Hp78KlJq+wdfjtMrtheY\n AnME9B0OjuE/PeScNy4qG/jmmjTmlkT4n99JkkQXTiJeiWZSkBAh/1zR/j59q5GiyTOCEIFw\n IZJNIBTdfHfwEYoPiRiaZk3zCVGgey+F7trwXXM0AY4IoBwvpB671RFxsrrbS/Pz7i1WgtW6\n oSK+u6OqmewRqZAqg+vYCzflxfFk6xKiAuKtLiZED3e2Lt0aHFCKyCDpsdMsTDSupO8WnqvB\n 4yJkoO6QyzyGT2Rv5eWI8S3/R7MTtJMt/K+fYJ8+/ltlHqKIcmpFrByft779g3D5dyKtRfWV\n s1FMHwoAdr7xEc8avcVbqTXSurFcnwMCYuM6G9zCB+q2yaKGhMzPA/LHlbGyS8QpO5H3ksp+\n bx/87wRw/0ScbT/eswhg53tZx//Gxf5zIMcPDytp/vwcyk1HWiDOwU0EY7Px1QEQALRjXzH1\n KoYC1+9B2+/s7EQWx5lfXimqnVG+qPl01q9qEPZqrjBwXOWJhLaFYLFa3GWOVxSpzRpZNL64\n wwmABJWQEWqDoW4p37q51TxjcQbs/P8jIy0tvDzYixWUj/NwBJnIuI5ge+GJ9xBtsN+e6/34\n pXs+hOAU2d9HPmpmU4WnRNqIfckBABZK5wB19Xhljo7usXKRciuJkTLp2rQDcmpxBv+VqqKW\n icFmW4iam6ZHuElU56/Li/U51L1LeMOCtXWnrKKoiaRSBK1XiItij1mYs6ayaBlxXk8xceeH\n bAHMgZXnltNJeog4S/1doGnrlJYkYcYdDu+Fzf+c5A5bFbe/s89uSpst3kbEqAD1AFEDBfgK\n Kc7CiI3L0uQJ0oYFRMMeu2FM1GMYFF24VZi72fI9WPpU0HmXF0ZouIcud2fcCVmG0S9euif0\n abPi/1Fhn4zIl7bG2+TeBeS28RYZA7XC4exbiPOPRETbFBsTWp8KloRNdIQGg3FCudMz2LKv\n UOu/IXafwBtgORLDr1dj2Ze2Krf4EkBJh8xRgCYbvBOycceyIkBb+F3IfDxqvmaDqnEnoJyS\n lZ84o8R3V3lhP2OD/Yvb+gBl+O/xXzfP6rRMrruZRFof3AXsuKKOcgDpIXd2/MsG/MK/HTHK\n 6KFfZCGUdTxhoAr3XVg8Q0CuwZ3jABEBAAHCwXYEGAEKACAWIQS5PGXKZwCHJiK1/0MQ2h7t\n p0QHbwUCY7Px1QIbDAAKCRAQ2h7tp0QHb9HKD/42ya1pLxmkJ7pAZeWIiszMwDEEmxbQicS9\n fZtjRN/IL3AiVvcWyN8cqsESx9xzCnjad+rCHr4PmuGvTHasolFHziCX5B2bCRAVAkGIBcJC\n 2mCPQEGZt8YysGS/y9KxqMgCy045pcBKtmPtRWab26+3FbkjJ/eje9vcDv2GyN09Rh6R57Zx\n 2hN4rZjZnbp7vfZPrKhPbIT2ckV5ZtUm9Er0/Vy/Lu/CrnOOYwJrpgLa8R3thBR9t0pDZdFd\n VAwl12qzt2C9Js+XjuxhYuywTtpvr8QgBhu4U/JN7OFfxD5WSanJ38KSFK3FeUdeqIfDDTQK\n d0f6ntHmjLqteo87cedJGwtFIZTW1a5eCZiKsfhosCSmrFw3DLDI5Cun7Sm1SWMShYzSpnSC\n i75PB8GYiH5T12ZSxRhRXCIri0OzPRYvfKZ82Ji33UUG5MZvqKpttEXaK8bxqmAg0TrJ+nLd\n jn99r9WDQokRITZRW4GCUDFY/K6p8MBfGM+sm3oi50hGXi4SRIYD0dZpC7QWRYNmhR9AsxWR\n EGoQV+X6XMEh1XFcBpExwvFrIpD+5SZrWp4e/lGLGA70EBHKFO15YL1Pv+fChskp3wRYr4mG\n Ao8E1tCv1TJZdkVZ7z93qUroOf8qi71FSzApqEHX7OyT3ad5/fYRzeme+3VlwGS6MHMWnpuo Og==","In-Reply-To":"<20230927004025.119111-1-cascardo@canonical.com>","X-BeenThere":"kernel-team@lists.ubuntu.com","X-Mailman-Version":"2.1.20","Precedence":"list","List-Id":"Kernel team discussions ","List-Unsubscribe":",\n ","List-Archive":"","List-Post":"","List-Help":"","List-Subscribe":",\n ","Content-Transfer-Encoding":"base64","Content-Type":"text/plain; charset=\"utf-8\"; Format=\"flowed\"","Errors-To":"kernel-team-bounces@lists.ubuntu.com","Sender":"\"kernel-team\" "}}]