Executive brief
The Linux kernel's IP VTI (Virtual Tunnel Interface) driver contains a memory safety flaw when transmitting IPv6 packets through certain network queue disciplines. An attacker with the ability to configure network interfaces and qdisc settings could trigger a use-after-free condition, potentially leading to kernel crash, privilege escalation, or arbitrary code execution on systems running vulnerable kernel versions.
Technical details
The vulnerability is a slab-use-after-free in the ip_vti driver's IPv6 packet transmission path (vti_tunnel_xmit function). When an ip_vti device is configured with an SFB (Stochastic Fairness Queueing) qdisc, the control buffer (cb) field of the skb (socket buffer) may be modified during enqueueing. The root cause is improper ordering: xfrm_decode_session() is called before clearing the cb field (memset), causing it to read or write stale data that may have been overwritten by the qdisc. The fix reorders these operations to clear IP6CB/IPCB before calling xfrm_decode_session, ensuring the cb field is clean before use. This is a local privilege escalation requiring the ability to configure network interfaces and qdisc settings. The patch was accepted upstream and backported to stable kernel branches.
Affected products
- Linux Linux kernel multiple versions prior to fix commit 6018a266279b1a75143c7c0804dd08a5fc4c3e0b
Timeline
- 2023-07-10: disclosed: Fix commit authored by Zhengchao Shao
- 2023-08: patched: Backported to stable kernel series starting with 6.1, 6.0, 5.19, etc.
- 2025-10-04: advisory: CVE-2023-53559 published