Threats tagged 'ghsa-7xvh-m494-6w6x'

A vulnerability in the Linux kernel's Open vSwitch (openvswitch) component was resolved that involved improper handling of packet skb flags during error processing. The issue caused the stripping of the SKBFL_SHARED_FRAG flag on a live socket buffer (skb) that was still being forwarded, leading to an unprivileged write to page-cache memory. This was due to skb_tx_error() being called on a packet that was not yet dropped, affecting in-place decryption of ESP-in-UDP packets and enabling a local page-cache write primitive. The fix moves the skb_tx_error() call to the appropriate flow-miss drop path to prevent this unsafe modification.