Oracle Linux: CVE-2024-41091: ELSA-2024-12581: Unbreakable Enterprise kernel security update (IMPORTANT) (Multiple Advisories)

Oracle Linux: CVE-2024-41091: ELSA-2024-12581: Unbreakable Enterprise kernel security update (IMPORTANT) (Multiple Advisories)

Severity

5

CVSS

(AV:L/AC:L/Au:N/C:N/I:N/A:C)

Published

07/24/2024

Created

08/20/2024

Added

08/16/2024

Modified

01/23/2025

Description

In the Linux kernel, the following vulnerability has been resolved: tun: add missing verification for short frame The cited commit missed to check against the validity of the frame length in the tun_xdp_one() path, which could cause a corrupted skb to be sent downstack. Even before the skb is transmitted, the tun_xdp_one-->eth_type_trans() may access the Ethernet header although it can be less than ETH_HLEN. Once transmitted, this could either cause out-of-bound access beyond the actual length, or confuse the underlayer with incorrect or inconsistent header length in the skb metadata. In the alternative path, tun_get_user() already prohibits short frame which has the length less than Ethernet header size from being transmitted for IFF_TAP. This is to drop any frame shorter than the Ethernet header size just like how tun_get_user() does. CVE: CVE-2024-41091 A denial of service (DoS) attack was found in the mlx5 driver in the Linux kernel. A KVM guest VM using virtio-net can crash the host by sending a short packet, for example, size < ETH_HLEN. The packet may traverse through vhost-net, macvtap, and vlan without any validation or drop. When this packet is presented to the mlx5 driver on the host side, the kernel panic happens since mlx5_core assumes the frame size is always >= ETH_HLEN.

Solution(s)

• oracle-linux-upgrade-kernel
• oracle-linux-upgrade-kernel-uek

References

• https://attackerkb.com/topics/cve-2024-41091
• CVE - 2024-41091
• ELSA-2024-12581
• ELSA-2024-5928
• ELSA-2024-12549
• ELSA-2024-7000
• ELSA-2024-12546
• ELSA-2024-12582
• ELSA-2024-12548
• ELSA-2024-12547
• ELSA-2024-12584
• ELSA-2024-12585
• ELSA-2024-12782
• ELSA-2024-12571
• ELSA-2024-12583
• ELSA-2024-12780
• ELSA-2024-12570
• ELSA-2024-12551
• ELSA-2024-12552
• ELSA-2024-12815

View more