In the Linux kernel, the following vulnerability has been resolved:
net: bcmasp: clear txcb->last before writing each descriptor
bcmasp_xmit() only wrote txcb->last = true for the final fragment
of an SKB; non-final fragments left the field untouched. If a
descriptor slot was reused while it still held a stale true from
a previous SKB (possible when tx_spb_ring_full() underreported
fullness), bcmasp_tx_reclaim() would see last == true mid-SKB and
call dev_consume_skb_any() prematurely, freeing the sk_buff while
its remaining fragments were still in flight.
Unconditionally clear txcb->last before the conditional set so every
descriptor slot starts from a known false state regardless of what a
prior transmission left behind.
Attack Parameters
Attack Vector
Local
Requires local access
Attack Complexity
Low
Easy to exploit
Privileges Required
Low
Basic privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
High
Complete data modification
Availability
High
Complete denial of service
CVSS Vector v3.1
References 4
https://git.kernel.org/stable/c/17e6ad484dea5ddf1c4a3d6ec77a5929161234de
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/18e5e0ec0e9282c897e2aa81a3e43ccaee03b003
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/47a5cecca925ceb175d5adf712e667acf78f475f
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/9b26b54861ce05307d39a54ddedddf8747419614
416baaa9-dc9f-4396-8d5f-8c081fb06d67