A Linux kernel vulnerability (), allowing remote denial of service via specially crafted UDP packets (packet-of-death). The issue is caused by a bug in the udp_gro_receive_segment handler (net/ipv4/udp_offload.c) with the implementation of the GRO (Generic Receive Offload) technology and can lead to corruption of kernel memory areas when processing UDP packets with zero fill (empty payload).
The issue only affects the kernel , as support for GRO for UDP sockets was in November last year and has only made it into the last stable release of the kernel. The GRO technology allows for faster processing of a large number of incoming packets by aggregating several packets into larger blocks that do not require separate processing for each packet.
For TCP, the issue does not manifest, as packet aggregation without payload is not supported for this protocol.
The vulnerability has only been fixed in a form of , the corrective update has not yet been released (the fix is not included in yesterday's update 5.0.11 ). Kernel 5.0 has managed to make it into , , , and other continuously updated distributions. , , és the issue does not affect.
The problem was identified as a result of an automated fuzz testing system created by Google and an analyzer (KernelAddressSanitizer), aimed at detecting memory errors and incorrect memory access, such as accesses to freed memory areas and placing code in memory areas not intended for such manipulations.
Forrás: opennet.ru
