sched cls_u32 Classifier OOB

Vulnerability analysis

Summary: The cls_u32 traffic classifier in the Linux kernel networking stack contains an out-of-bounds read vulnerability due to insufficient validation of negative offset values in skb_header_pointer().

Root Cause: The skb_header_pointer() function does not fully validate negative offset values, allowing attackers to craft malicious network packets with negative offsets that can cause the kernel to read memory outside the intended buffer boundaries. The vulnerability occurs in the u32_classify() function when processing packet classification rules.

Attack Mechanism: An attacker can send specially crafted network packets with manipulated offset values that bypass the existing validation in skb_header_pointer(). When these packets are processed by the u32 classifier, the negative offsets can cause out-of-bounds memory reads, potentially leading to information disclosure or system crashes.

Fix Mechanism: The patch replaces all calls to skb_header_pointer() with skb_header_pointer_careful() in the cls_u32 classifier. The 'careful' variant includes additional validation to properly handle negative offset values and prevent out-of-bounds access. It also removes a manual overflow check that is now redundant since the careful function handles this validation internally.