In the Linux kernel, the following vulnerability has been resolved:
net: fix crash when config small gsomaxsize/gsoipv4max_size
Config a small gsomaxsize/gsoipv4maxsize will lead to an underflow in skdstgsomaxsize(), which may trigger a BUGON crash, because sk->skgsomaxsize would be much bigger than device limits. Call Trace: tcpwritexmit tsosegs = tcpinittsosegs(skb, mssnow); tcpsetskbtsosegs tcpskbpcountset // skb->len = 524288, mssnow = 8 // u16 tsosegs = 524288/8 = 65535 -> 0 tsosegs = DIVROUNDUP(skb->len, mssnow) BUGON(!tsosegs) Add check for the minimum value of gsomaxsize and gsoipv4maxsize.
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/50xxx/CVE-2024-50258.json"
}"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-50258.json"
[
{
"signature_version": "v1",
"target": {
"file": "net/core/rtnetlink.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e9365368b483328639c03fc730448dccd5a25b6b",
"deprecated": false,
"digest": {
"line_hashes": [
"82935720421694966240511289873511728766",
"50628189030501469470673204413379211485",
"65005603284359289761702964138031906100",
"221669732273946795428972864018354416367"
],
"threshold": 0.9
},
"id": "CVE-2024-50258-3bb37730",
"signature_type": "Line"
}
]