Executive brief
A vulnerability was identified in the Linux kernel's networking component responsible for Foo-over-UDP (FOU) encapsulation. This flaw could allow a local attacker to cause a system crash or potentially access sensitive information from the system's memory. The issue has been resolved in recent kernel updates, and administrators are advised to apply the latest security patches for their Linux distributions.
Technical details
A 'Use of Uninitialized Resource' (CWE-908) vulnerability exists in net/ipv4/fou.c (or fou_core.c in some versions) within the gue_gro_receive function. The root cause is a logic error where a 'goto out' statement is executed if the 'fou' pointer is NULL before the 'grc' (Generic Receive Offload remote checksum) structure is initialized. Consequently, the uninitialized 'grc' structure is used in subsequent operations. A local attacker can exploit this to trigger a kernel panic (DoS) or potentially leak kernel memory contents. Patches have been released across multiple stable kernel branches (5.10.y, 5.15.y, 6.1.y, 6.6.y, 6.10.y).
Affected products
- Linux Linux Kernel 5.10.226, 5.15.167, 6.1.110, 6.6.51, 6.10.10
Timeline
- 2024-09-27: advisory: NVD publication date
- 2024-09-09: patched: Initial fix committed to mainline kernel
References
- https://git.kernel.org/stable/c/16ff0895283058b0f96d4fe277aa25ee096f0ea8
- https://git.kernel.org/stable/c/392f6a97fcbecc64f0c00058b2db5bb0e4b8cc3e
- https://git.kernel.org/stable/c/4c8002277167125078e6b9b90137bdf443ebaa08
- https://git.kernel.org/stable/c/5d537b8d900514509622ce92330b70d2e581d409
- https://git.kernel.org/stable/c/7ae890ee19479eeeb87724cca8430b5cb3660c74
- https://git.kernel.org/stable/c/aca06c617c83295f0caa486ad608fbef7bdc11e8
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html