Threats Tagged 'ghsa-9mvj-23j7-q46q'

A vulnerability in the Linux kernel's xsk (AF_XDP socket) subsystem related to insufficient validation of userspace-supplied xdp_desc structures has been resolved. Invalid values in xdp_desc can bypass validation checks, potentially causing undefined behavior or queuing invalid frames for transmission. Specifically, desc->len values near the maximum 32-bit unsigned integer with non-zero tx_metadata_len can cause integer overflow, and low desc->addr values can cause negative overflow, both allowing invalid data to pass validation. The issue does not affect valid XSk applications but could be exploited by crafted inputs. The fix involves promoting desc->len to 64-bit and using explicit overflow checks for desc->addr. No affected versions are explicitly stated. The vulnerability has a high severity rating based on CVSS 3.1 metrics.