PT-2026-115782
تاريخ النشر
2026-10-06
·
تاريخ التحديث
2026-10-06
الوصف من
الدرجة
N/A
غير متوفرلا تتوفر حاليًا تقييمات أو مقاييس للخطورة. سنحدّث المعلومات المقابلة في الصفحة فور توفرها.
In the Linux kernel, the following vulnerability has been resolved:
pppoatm: ensure a writable skb header and linear data
In pppoatm send(), LLC encapsulation checks whether there is sufficient
headroom for the 4-byte LLC header, but does not ensure that the skb header
is writable.
Normal transmit packets passing through ppp start xmit() have their header
unshared via skb cow head(). However, packets can also reach pppoatm send()
via PPP channel bridging (PPPIOCBRIDGECHAN) without going through
ppp start xmit().
Use skb cow head() to ensure both sufficient headroom and a writable
header before pushing the LLC header.
While at it:
- Call pskb may pull(skb, 1) before inspecting skb->data[0] to prevent out-of-bounds reads on zero-length or non-linear frames (e.g. from bridging).
- Defer SC COMP PROT protocol compression until after pppoatm may send() succeeds. This eliminates the temporary skb allocation on admission failure and completely removes the fragile "undo" heuristic at the nospace label, avoiding any risk of reading uninitialized headroom or performing an unbalanced skb push().
المورّدون
المنتجات المتأثرة
المعرّفات ذات الصلة
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾