ipip: fix skb leak in collect_md mode when metadata_dst allocation fails
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 6.1.188, 6.6.157, 6.12.109, 6.18.50, 7.2.4
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
In the Linux kernel, the following vulnerability has been resolved: ipip: fix skb leak in collect_md mode when metadata_dst allocation fails In collect_md mode ipip_tunnel_rcv() returns 0 without freeing the skb when ip_tun_rx_dst() fails to allocate the metadata_dst. ipip_rcv() and mplsip_rcv() are registered as xfrm_tunnel handlers, so tunnel4_rcv() and tunnelmpls4_rcv() read the zero return as "the packet has been consumed" and do not free it either. The skb is leaked. The other tunnel drivers all dispose of the packet at this point: ip6_tunnel.c jumps to its drop label, ip_gre.c and ip6_gre.c return PACKET_REJECT, which makes gre_rcv() free the skb. Only ipip returns 0. Jump to the existing drop label instead. It frees the skb and still returns 0, so the packet keeps being reported as consumed, which is what we want here: the outer header has already been pulled, and neither the remaining handlers nor an ICMP unreachable have any use for it. Triggering this needs an ipip or mplsip tunnel in collect_md mode and an atomic allocation failure, which is why it has gone unnoticed.
Timeline
- CVE published
- Record last updated
Affected versions
- Linux Linux
From cfc7381b3002756b1dcada32979e942aa3126e31 · fixed in 1909df2d066424767429e13053eb9701263430ef; From cfc7381b3002756b1dcada32979e942aa3126e31 · fixed in c4dc23de4cc75e4e304170b31bb8aeeacd5cb990; From cfc7381b3002756b1dcada32979e942aa3126e31 · fixed in 6d8c5b266d0035a061573843a7243be068eb6118; From cfc7381b3002756b1dcada32979e942aa3126e31 · fixed in 31e4be21dacee49395013caae28576484a049a4f; From cfc7381b3002756b1dcada32979e942aa3126e31 · fixed in fd01f1a3ed4a189a784654f7c69eb565872f2e12; From cfc7381b3002756b1dcada32979e942aa3126e31 · fixed in 6776efe4a52f289a3fc18f8adf19b035a7d8e1bb
- Linux Linux
4.9
- KernelLinux
From 4.9.0 · fixed in 6.1.188; From 6.2.0 · fixed in 6.6.157; From 6.7.0 · fixed in 6.12.109; From 6.13.0 · fixed in 6.18.50; From 6.19.0 · fixed in 7.2.4