In the Linux kernel, the following vulnerability has been resolved:
ipvlan: add ipvlan_route_v6_outbound() helper
Inspired by syzbot reports using a stack of multiple ipvlan devices.
Reduce stack size needed in ipvlan_process_v6_outbound() by moving the flowi6 struct used for the route lookup in an non inlined helper. ipvlan_route_v6_outbound() needs 120 bytes on the stack, immediately reclaimed.
Also make sure ipvlan_process_v4_outbound() is not inlined.
We might also have to lower MAX_NEST_DEV, because only syzbot uses setups with more than four stacked devices.
BUG: TASK stack guard page was hit at ffffc9000e803ff8 (stack is ffffc9000e804000..ffffc9000e808000) stack guard page: 0000 [#1] SMP KASAN CPU: 0 PID: 13442 Comm: syz-executor.4 Not tainted 6.1.52-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/09/2023 RIP: 0010:kasan_check_range+0x4/0x2a0 mm/kasan/generic.c:188 Code: 48 01 c6 48 89 c7 e8 db 4e c1 03 31 c0 5d c3 cc 0f 0b eb 02 0f 0b b8 ea ff ff ff 5d c3 cc 00 00 cc cc 00 00 cc cc 55 48 89 e5 <41> 57 41 56 41 55 41 54 53 b0 01 48 85 f6 0f 84 a4 01 00 00 48 89 RSP: 0018:ffffc9000e804000 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff817e5bf2 RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffffff887c6568 RBP: ffffc9000e804000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: dffffc0000000001 R12: 1ffff92001d0080c R13: dffffc0000000000 R14: ffffffff87e6b100 R15: 0000000000000000 FS: 00007fd0c55826c0(0000) GS:ffff8881f6800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffc9000e803ff8 CR3: 0000000170ef7000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <#DF> </#DF> <TASK> [<ffffffff81f281d1>] __kasan_check_read+0x11/0x20 mm/kasan/shadow.c:31 [<ffffffff817e5bf2>] instrument_atomic_read include/linux/instrumented.h:72 [inline] [<ffffffff817e5bf2>] _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline] [<ffffffff817e5bf2>] cpumask_test_cpu include/linux/cpumask.h:506 [inline] [<ffffffff817e5bf2>] cpu_online include/linux/cpumask.h:1092 [inline] [<ffffffff817e5bf2>] trace_lock_acquire include/trace/events/lock.h:24 [inline] [<ffffffff817e5bf2>] lock_acquire+0xe2/0x590 kernel/locking/lockdep.c:5632 [<ffffffff8563221e>] rcu_lock_acquire+0x2e/0x40 include/linux/rcupdate.h:306 [<ffffffff8561464d>] rcu_read_lock include/linux/rcupdate.h:747 [inline] [<ffffffff8561464d>] ip6_pol_route+0x15d/0x1440 net/ipv6/route.c:2221 [<ffffffff85618120>] ip6_pol_route_output+0x50/0x80 net/ipv6/route.c:2606 [<ffffffff856f65b5>] pol_lookup_func include/net/ip6_fib.h:584 [inline] [<ffffffff856f65b5>] fib6_rule_lookup+0x265/0x620 net/ipv6/fib6_rules.c:116 [<ffffffff85618009>] ip6_route_output_flags_noref+0x2d9/0x3a0 net/ipv6/route.c:2638 [<ffffffff8561821a>] ip6_route_output_flags+0xca/0x340 net/ipv6/route.c:2651 [<ffffffff838bd5a3>] ip6_route_output include/net/ip6_route.h:100 [inline] [<ffffffff838bd5a3>] ipvlan_process_v6_outbound drivers/net/ipvlan/ipvlan_core.c:473 [inline] [<ffffffff838bd5a3>] ipvlan_process_outbound drivers/net/ipvlan/ipvlan_core.c:529 [inline] [<ffffffff838bd5a3>] ipvlan_xmit_mode_l3 drivers/net/ipvlan/ipvlan_core.c:602 [inline] [<ffffffff838bd5a3>] ipvlan_queue_xmit+0xc33/0x1be0 drivers/net/ipvlan/ipvlan_core.c:677 [<ffffffff838c2909>] ipvlan_start_xmit+0x49/0x100 drivers/net/ipvlan/ipvlan_main.c:229 [<ffffffff84d03900>] netdev_start_xmit include/linux/netdevice.h:4966 [inline] [<ffffffff84d03900>] xmit_one net/core/dev.c:3644 [inline] [<ffffffff84d03900>] dev_hard_start_xmit+0x320/0x980 net/core/dev.c:3660 [<ffffffff84d080e2>] __dev_queue_xmit+0x16b2/0x3370 net/core/dev.c:4324 [<ffffffff855ce4cd>] dev_queue_xmit include/linux/netdevice.h:3067 [inline] [<ffffffff855ce4cd>] neigh_hh_output include/net/neighbour.h:529 [inline] [<f ---truncated---
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-rt-debugUpgrade kernel-rt-coreUpgrade kernel-cross-headersUpgrade kernel-rt-debug-develUpgrade kernel-develUpgrade kernel-debug-coreUpgrade kernelUpgrade kernel-rt-modules-extraUpgrade python3-perfUpgrade kernel-zfcpdump-develUpgrade kernel-modules-extraUpgrade kernel-debugUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-debug-develUpgrade kernel-coreUpgrade kernel-rt-debug-kvmUpgrade kernel-modulesUpgrade kernel-rt-debug-coreUpgrade kernel-headersUpgrade kernel-zfcpdump-modulesUpgrade kernel-zfcpdump-coreUpgrade kernel-zfcpdumpUpgrade kernel-docUpgrade kernel-rt-modulesUpgrade kernel-rt-debug-modules-extraUpgrade kernel-rt-debug-modulesUpgrade perfUpgrade kernel-abi-stablelistsUpgrade kernel-rt-kvmUpgrade kernel-debug-modulesUpgrade kernel-rtUpgrade kernel-tools-libs-develUpgrade kernel-tools-libsUpgrade kernel-toolsUpgrade kernel-debug-modules-extraUpgrade kernel-rt-develUpgrade bpftool | Aug 12, 2024 | May 21, 2024 |
| Amazon Linux Ami 2 | — | Upgrade kernel-debuginfoUpgrade kernel-tools-develUpgrade perf-debuginfoUpgrade kernel-tools-debuginfoUpgrade perfUpgrade kernel-livepatch-5.15.145-95.156Upgrade kernel-debuginfo-common-aarch64Upgrade bpftoolUpgrade kernel-develUpgrade python-perf-debuginfoUpgrade kernel-livepatch-4.14.349-266.564Upgrade kernelUpgrade kernel-headersUpgrade python-perfUpgrade kernel-livepatch-5.10.205-195.804Upgrade kernel-debuginfo-common-x86_64Upgrade bpftool-debuginfoUpgrade kernel-tools | Jun 26, 2024 | May 21, 2024 |
| Amazon_linux_2023 | — | Upgrade kernel-livepatch-6.1.66-91.160Upgrade kernel-headersUpgrade kernel-libbpf-develUpgrade kernel-modules-extraUpgrade perfUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-debuginfoUpgrade bpftoolUpgrade perf-debuginfoUpgrade kernel-libbpfUpgrade kernel-tools-develUpgrade kernel-develUpgrade kernel-libbpf-staticUpgrade kernelUpgrade python3-perf-debuginfoUpgrade python3-perfUpgrade kernel-tools-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-toolsUpgrade bpftool-debuginfo | Feb 17, 2025 | May 21, 2024 |
| Debian | — | Upgrade linux | Jul 30, 2024 | May 21, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade kernel-abi-stablelistsUpgrade python3-perfUpgrade kernel-tools-libsUpgrade kernelUpgrade kernel-tools | Oct 8, 2024 | May 21, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade kernelUpgrade bpftoolUpgrade python3-perfUpgrade kernel-abi-stablelistsUpgrade kernel-tools-libsUpgrade kernel-tools | Oct 8, 2024 | May 21, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade kernel-toolsUpgrade kernel-tools-libsUpgrade python3-perfUpgrade kernel | Oct 8, 2024 | May 21, 2024 |
| Oracle_linux | — | Upgrade kernelUpgrade kernel-uek | Aug 16, 2024 | May 21, 2024 |
| Redhat_linux | — | Upgrade kernelUpgrade kernel-rtNo solution exists | Aug 12, 2024 | May 21, 2024 |
| Rocky_linux | — | Upgrade python3-perf-debuginfoUpgrade kernel-develUpgrade kernel-rtUpgrade kernel-rt-debuginfo-common-x86_64Upgrade kernel-rt-kvmUpgrade kernel-debug-modulesUpgrade kernel-rt-debug-coreUpgrade kernel-toolsUpgrade kernel-tools-libs-develUpgrade kernel-debug-debuginfoUpgrade kernel-rt-develUpgrade kernel-rt-modulesUpgrade kernel-rt-debuginfoUpgrade python3-perfUpgrade kernel-rt-debug-debuginfoUpgrade perfUpgrade bpftool-debuginfoUpgrade kernel-rt-debugUpgrade kernel-rt-modules-extraUpgrade kernel-tools-libsUpgrade bpftoolUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-debug-modules-extraUpgrade perf-debuginfoUpgrade kernelUpgrade kernel-coreUpgrade kernel-rt-debug-kvmUpgrade kernel-modules-extraUpgrade kernel-debug-coreUpgrade kernel-rt-debug-modules-extraUpgrade kernel-rt-debug-develUpgrade kernel-modulesUpgrade kernel-headersUpgrade kernel-debug-develUpgrade kernel-rt-debug-modulesUpgrade kernel-debuginfoUpgrade kernel-debugUpgrade kernel-tools-debuginfoUpgrade kernel-rt-coreUpgrade kernel-cross-headers | Aug 22, 2024 | May 21, 2024 |
| Suse | — | Upgrade kernel-kvmsmall-livepatch-develUpgrade kernel-debugUpgrade kernel-rt-livepatchUpgrade kernel-azure-develUpgrade dtb-lgUpgrade kernel-kvmsmall-vdsoUpgrade kernel-macrosUpgrade cluster-md-kmp-defaultUpgrade kernel-azure-optionalUpgrade kernel-default-extraUpgrade kernel-default-livepatchUpgrade dtb-xilinxUpgrade kernel-source-azureUpgrade kernel-64kb-livepatch-develUpgrade cluster-md-kmp-azureUpgrade dtb-amlogicUpgrade kernel-azure-extraUpgrade kernel-obs-qaUpgrade dtb-freescaleUpgrade kernel-64kbUpgrade ocfs2-kmp-64kbUpgrade ocfs2-kmp-rtUpgrade kselftests-kmp-64kbUpgrade dlm-kmp-64kbUpgrade dtb-appleUpgrade dtb-exynosUpgrade kernel-zfcpdumpUpgrade cluster-md-kmp-rtUpgrade kernel-rt_debug-develUpgrade dtb-apmUpgrade dtb-amazonUpgrade gfs2-kmp-rtUpgrade kernel-default-optionalUpgrade dtb-broadcomUpgrade kernel-syms-azureUpgrade kselftests-kmp-azureUpgrade kernel-64kb-optionalUpgrade dtb-alteraUpgrade kernel-devel-azureUpgrade kernel-64kb-develUpgrade gfs2-kmp-64kbUpgrade kernel-default-develUpgrade kernel-rtUpgrade kernel-source-rtUpgrade kernel-default-vdsoUpgrade reiserfs-kmp-64kbUpgrade kernel-sourceUpgrade dtb-hisiliconUpgrade kernel-kvmsmall-develUpgrade dtb-caviumUpgrade kernel-docs-htmlUpgrade dtb-qcomUpgrade kernel-kvmsmallUpgrade kernel-symsUpgrade dtb-marvellUpgrade gfs2-kmp-azureUpgrade kernel-azure-baseUpgrade kernel-azure-livepatch-develUpgrade kernel-debug-livepatch-develUpgrade kernel-syms-rtUpgrade kernel-docsUpgrade kernel-rt_debugUpgrade kselftests-kmp-rtUpgrade dtb-renesasUpgrade dtb-socionextUpgrade reiserfs-kmp-defaultUpgrade kernel-rt_debug-livepatch-develUpgrade dlm-kmp-defaultUpgrade kernel-default-base-rebuildUpgrade dlm-kmp-rtUpgrade kernel-devel-rtUpgrade dlm-kmp-azureUpgrade dtb-allwinnerUpgrade kernel-default-baseUpgrade kernel-64kb-extraUpgrade kernel-rt-livepatch-develUpgrade cluster-md-kmp-64kbUpgrade ocfs2-kmp-defaultUpgrade dtb-rockchipUpgrade kernel-azure-vdsoUpgrade dtb-sprdUpgrade reiserfs-kmp-azureUpgrade kernel-rt_debug-vdsoUpgrade dtb-mediatekUpgrade kernel-develUpgrade gfs2-kmp-defaultUpgrade dtb-amdUpgrade dtb-armUpgrade dtb-nvidiaUpgrade kernel-obs-buildUpgrade kernel-debug-develUpgrade kernel-rt-optionalUpgrade kselftests-kmp-defaultUpgrade kernel-rt-develUpgrade kernel-rt-extraUpgrade kernel-defaultUpgrade kernel-azureUpgrade kernel-debug-vdsoUpgrade kernel-source-vanillaUpgrade kernel-rt-vdsoUpgrade kernel-default-manUpgrade kernel-default-livepatch-develUpgrade ocfs2-kmp-azureUpgrade reiserfs-kmp-rt | Jun 12, 2024 | May 21, 2024 |
| Ubuntu | — | Upgrade linux-nvidia-tegra-5.15Upgrade linux-oracleUpgrade linux-azure-5.15Upgrade linux-oracle-5.15Upgrade linux-riscv-5.15Upgrade linux-gkeopUpgrade linux-oracle-5.4Upgrade linux-lowlatency-hwe-5.15Upgrade linux-intel-iotgUpgrade linux-bluefieldUpgrade linux-ibm-5.15Upgrade linux-gkeUpgrade linux-nvidia-tegra-igxUpgrade linux-aws-5.15Upgrade linux-nvidia-tegraUpgrade linux-gcpUpgrade linux-nvidiaUpgrade linux-gcp-5.15Upgrade linux-xilinx-zynqmpUpgrade linux-raspi-5.4Upgrade linux-realtimeUpgrade linux-gcp-5.4Upgrade linux-fipsUpgrade linux-intel-iot-realtimeUpgrade linux-kvmUpgrade linux-ibmUpgrade linux-intel-iotg-5.15Upgrade linux-gkeop-5.15Upgrade linux-ibm-5.4Upgrade linux-gcp-fipsUpgrade linux-azure-fipsUpgrade linux-aws-5.4Upgrade linux-iotUpgrade linux-lowlatencyUpgrade linux-nvidia-6.5Upgrade linux-azureUpgrade linux-raspiUpgrade linux-hwe-5.4Upgrade linux-azure-fdeUpgrade linux-awsUpgrade linuxUpgrade linux-aws-fipsUpgrade linux-azure-5.4Upgrade linux-hwe-5.15 | Nov 19, 2024 | May 21, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | May 21, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub