In the Linux kernel, the following vulnerability has been resolved:
net: skbuff: don't skb_tx_error() the source skb in skb_zerocopy()
skb_zerocopy() copies frags from @from into @to. On an
skb_orphan_frags() failure it calls skb_tx_error(@from), a destructive
operation on the source skb the copy helper does not own. That completes
@from's zerocopy uarg and clears SKBFL_ALL_ZEROCOPY, including the
SKBFL_SHARED_FRAG page-ownership marker.
Both callers already report the failure on their own drop path.
nfnetlink_queue does it at nla_put_failure, and Open vSwitch does it in
the flow-miss drop arm of ovs_dp_process_packet(), so nothing is lost by
dropping it here.
On Open vSwitch's OVS_ACTION_ATTR_USERSPACE path the skb is not freed on
this error: do_execute_actions() ignores output_userspace()'s return
value and, unless the upcall was the last action, keeps forwarding the
same skb through the flow's remaining actions. The uarg is completed
while that skb is still in flight, telling the producer its buffers are
free, and SKBFL_SHARED_FRAG is cleared on an skb the rest of the stack
still handles. That flag is what makes esp_input() call skb_cow_data()
instead of decrypting in place, so a later local ESP delivery can
decrypt over frags the skb does not own privately.
Leave error reporting to the callers.
CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS Score: 9.3
AV:L - skb_zerocopy() only skb_tx_error()s the source when skb_orphan_frags() fails, which requires a still-attached zerocopy uarg without SKBFL_DONT_ORPHAN (vhost-net, xen-netback, AF_PACKET mmap); ordinary remote NIC packets never carry that uarg.
AC:L - The attacker drives zerocopy TX and can fail skb_copy_ubufs() without an uncontrolled race (non-last OVS OUTPUT clones the skb so skb_shared() is set, or induced GFP_ATOMIC pressure); do_execute_actions() ignores the USERSPACE error and keeps forwarding.
PR:N - A KVM/Xen guest using vhost-net or xen-netback needs no host account, capability, or /dev/vhost-net fd—only virtio/netback TX on the provisioned vNIC.
UI:N - Guest or local zerocopy TX and in-kernel OVS USERSPACE-then-forward processing run without the victim mounting, opening a file, or otherwise interacting.
S:C - vhost-net and xen-netback are host/Dom0 kernel code on the guest NIC boundary; premature uarg completion and SKBFL_SHARED_FRAG removal run in host context from guest zerocopy TX, impacting host kernel state outside the guest authority.
C:H - skb_tx_error() completes the uarg while the skb is still forwarded and clears SKBFL_SHARED_FRAG, so later esp_input() skips skb_cow_data() and decrypts in place over producer-reused frags, a UAF/in-place primitive that can disclose host-held page contents.
I:H - In-place ESP decrypt over frags the skb does not own privately, plus premature zerocopy completion, writes attacker-influenced data into pages still referenced by the in-flight host skb, a write primitive suitable for integrity compromise and control-flow impact.
A:H - Reuse of zerocopy pages still referenced by the forwarded skb, and in-place overwrites of those pages, cause host oopses and panics that can be retriggered from guest or local TX until the host is unavailable.
| Attack Vector |
Local |
Scope |
Changed |
| Attack Complexity |
Low |
Confidentiality Impact |
High |
| Privileges Required |
None |
Integrity Impact |
High |
| User Interaction |
None |
Availability Impact |
High |
AV:L - skb_zerocopy() only skb_tx_error()s the source when skb_orphan_frags() fails, which requires a still-attached zerocopy uarg without SKBFL_DONT_ORPHAN (vhost-net, xen-netback, AF_PACKET mmap); ordinary remote NIC packets never carry that uarg.
AC:L - The attacker drives zerocopy TX and can fail skb_copy_ubufs() without an uncontrolled race (non-last OVS OUTPUT clones the skb so skb_shared() is set, or induced GFP_ATOMIC pressure); do_execute_actions() ignores the USERSPACE error and keeps forwarding.
PR:N - A KVM/Xen guest using vhost-net or xen-netback needs no host account, capability, or /dev/vhost-net fd—only virtio/netback TX on the provisioned vNIC.
UI:N - Guest or local zerocopy TX and in-kernel OVS USERSPACE-then-forward processing run without the victim mounting, opening a file, or otherwise interacting.
S:C - vhost-net and xen-netback are host/Dom0 kernel code on the guest NIC boundary; premature uarg completion and SKBFL_SHARED_FRAG removal run in host context from guest zerocopy TX, impacting host kernel state outside the guest authority.
C:H - skb_tx_error() completes the uarg while the skb is still forwarded and clears SKBFL_SHARED_FRAG, so later esp_input() skips skb_cow_data() and decrypts in place over producer-reused frags, a UAF/in-place primitive that can disclose host-held page contents.
I:H - In-place ESP decrypt over frags the skb does not own privately, plus premature zerocopy completion, writes attacker-influenced data into pages still referenced by the in-flight host skb, a write primitive suitable for integrity compromise and control-flow impact.
A:H - Reuse of zerocopy pages still referenced by the forwarded skb, and in-place overwrites of those pages, cause host oopses and panics that can be retriggered from guest or local TX until the host is unavailable.
CVSS 3.1