In the Linux kernel, the following vulnerability has been resolved:
net: bcmasp: clear txcb->last before writing each descriptor
bcmasp_xmit() only wrote txcb->last = true for the final fragment
of an SKB; non-final fragments left the field untouched. If a
descriptor slot was reused while it still held a stale true from
a previous SKB (possible when tx_spb_ring_full() underreported
fullness), bcmasp_tx_reclaim() would see last == true mid-SKB and
call dev_consume_skb_any() prematurely, freeing the sk_buff while
its remaining fragments were still in flight.
Unconditionally clear txcb->last before the conditional set so every
descriptor slot starts from a known false state regardless of what a
prior transmission left behind.
CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 7.8
AV:L - The bug is in bcmasp_xmit() TX ring bookkeeping, reached via sendmsg/sendfile -> dev_queue_xmit -> bcmasp_xmit; no malformed input exists and the trigger is TX ring pressure from multi-fragment (NETIF_F_SG) SKBs, which a local user produces by flooding sockets through the bcmasp interface.
AC:L - The attacker controls the traffic load: flooding multi-frag SKBs makes buggy tx_spb_ring_full() let bcmasp_xmit overwrite unreclaimed slots, so non-final fragments repeatedly land in slots holding a stale txcb->last=true; no hardware state outside the attacker's control is needed.
PR:L - Sending TCP/UDP traffic that egresses the bcmasp netdev needs only an ordinary unprivileged local account; there is no capability check anywhere on the transmit path.
UI:N - No victim action is involved; the attacker generates the transmit traffic entirely by themselves.
S:U - The corruption affects kernel sk_buff/page memory in the same kernel that runs the driver; no VM or IOMMU boundary is crossed.
C:H - bcmasp_tx_reclaim() frees the skb (dev_consume_skb_any) while its later fragments are still mapped for DMA, so freed and reallocated pages can be transmitted on the wire and the stale skb is accessed again: a use-after-free with disclosure potential.
I:H - When the real final fragment is reclaimed later, dev_consume_skb_any() is called a second time on the same skb, a double free/UAF of sk_buff and frag pages that could be groomed into slab corruption.
A:H - Double freeing the sk_buff and touching freed memory in bcmasp_tx_reclaim() from TX NAPI causes slab corruption and kernel oops/panic on the host.
| Attack Vector |
Local |
Scope |
Unchanged |
| Attack Complexity |
Low |
Confidentiality Impact |
High |
| Privileges Required |
Low |
Integrity Impact |
High |
| User Interaction |
None |
Availability Impact |
High |
AV:L - The bug is in bcmasp_xmit() TX ring bookkeeping, reached via sendmsg/sendfile -> dev_queue_xmit -> bcmasp_xmit; no malformed input exists and the trigger is TX ring pressure from multi-fragment (NETIF_F_SG) SKBs, which a local user produces by flooding sockets through the bcmasp interface.
AC:L - The attacker controls the traffic load: flooding multi-frag SKBs makes buggy tx_spb_ring_full() let bcmasp_xmit overwrite unreclaimed slots, so non-final fragments repeatedly land in slots holding a stale txcb->last=true; no hardware state outside the attacker's control is needed.
PR:L - Sending TCP/UDP traffic that egresses the bcmasp netdev needs only an ordinary unprivileged local account; there is no capability check anywhere on the transmit path.
UI:N - No victim action is involved; the attacker generates the transmit traffic entirely by themselves.
S:U - The corruption affects kernel sk_buff/page memory in the same kernel that runs the driver; no VM or IOMMU boundary is crossed.
C:H - bcmasp_tx_reclaim() frees the skb (dev_consume_skb_any) while its later fragments are still mapped for DMA, so freed and reallocated pages can be transmitted on the wire and the stale skb is accessed again: a use-after-free with disclosure potential.
I:H - When the real final fragment is reclaimed later, dev_consume_skb_any() is called a second time on the same skb, a double free/UAF of sk_buff and frag pages that could be groomed into slab corruption.
A:H - Double freeing the sk_buff and touching freed memory in bcmasp_tx_reclaim() from TX NAPI causes slab corruption and kernel oops/panic on the host.
CVSS 3.1