Executive brief
The Linux kernel's HSR (High-availability Seamless Redundancy) networking module contains an uninitialized memory access vulnerability in the frame forwarding logic. An attacker with local network access can craft specially-formatted packets that trigger uninitialized value usage, potentially causing a kernel crash (denial of service) or information disclosure.
Technical details
The vulnerability is an uninitialized-value access (KMSAN bug) in the fill_frame_info() function in net/hsr/hsr_forward.c. The root cause is that the HSR driver does not properly handle 802.1Q VLAN-tagged frames; when a VLAN protocol tag (ETH_P_8021Q) is encountered during frame processing in hsr_forward_skb(), uninitialized data is read, leading to kernel memory corruption. The vulnerability is reachable via local packet transmission through the network stack (sendto syscall on raw sockets). An attacker can cause a kernel panic or leak sensitive memory. The fix involves returning an error when a VLAN-tagged packet is encountered, effectively rejecting VLAN traffic until proper support is implemented.
Affected products
- Linux Linux kernel <UNKNOWN>
Timeline
- 2025-10-01: disclosed
- 2023: advisory: CVE-2023-53462