Executive brief
A vulnerability was identified in the Linux kernel's networking subsystem, specifically affecting how it handles tunneled IP traffic. This flaw could allow an attacker to trigger a system crash or potentially access sensitive information by sending specially crafted network packets. The issue affects systems using IP tunneling (like GRE) and has been addressed in recent kernel updates.
Technical details
A vulnerability exists in net/ipv4/ip_tunnel.c within the ip_tunnel_rcv() function of the Linux kernel. The root cause is a failure to ensure the inner header is pulled into the linear area of the socket buffer (skb) before accessing it, specifically after a pskb_inet_may_pull() call which might reallocate the skb head. This leads to an 'uninit-value' bug (as reported by KMSAN) during ECN decapsulation. An attacker can exploit this by sending malformed tunneled packets (e.g., GRE) to trigger the use of uninitialized memory. The fix involves saving the network header offset and recomputing the pointer after ensuring the header is present in the skb head.
Affected products
- Linux Linux Kernel Fixed in 5.10.214, 5.15.153, 6.1.83, 6.6.23, 6.7.11, 6.8.2
Timeline
- 2024-03-07: patched: Initial patch authored by Eric Dumazet
- 2024-04-17: disclosed: CVE published in NVD
References
- https://git.kernel.org/stable/c/5c03387021cfa3336b97e0dcba38029917a8af2a
- https://git.kernel.org/stable/c/60044ab84836359534bd7153b92e9c1584140e4a
- https://git.kernel.org/stable/c/77fd5294ea09b21f6772ac954a121b87323cec80
- https://git.kernel.org/stable/c/b0ec2abf98267f14d032102551581c833b0659d3
- https://git.kernel.org/stable/c/c4c857723b37c20651300b3de4ff25059848b4b0
- https://git.kernel.org/stable/c/ca914f1cdee8a85799942c9b0ce5015bbd6844e1
- https://git.kernel.org/stable/c/ec6bb01e02cbd47781dd90775b631a1dc4bd9d2b