In the Linux kernel, the following vulnerability has been resolved:
erspan: make sure erspan_base_hdr is present in skb->head
syzbot reported a problem in ip6erspan_rcv() [1]
Issue is that ip6erspan_rcv() (and erspan_rcv()) no longer make sure erspan_base_hdr is present in skb linear part (skb->head) before getting @ver field from it.
Add the missing pskb_may_pull() calls.
v2: Reload iph pointer in erspan_rcv() after pskb_may_pull() because skb->head might have changed.
[1]
BUG: KMSAN: uninit-value in pskb_may_pull_reason include/linux/skbuff.h:2742 [inline] BUG: KMSAN: uninit-value in pskb_may_pull include/linux/skbuff.h:2756 [inline] BUG: KMSAN: uninit-value in ip6erspan_rcv net/ipv6/ip6_gre.c:541 [inline] BUG: KMSAN: uninit-value in gre_rcv+0x11f8/0x1930 net/ipv6/ip6_gre.c:610 pskb_may_pull_reason include/linux/skbuff.h:2742 [inline] pskb_may_pull include/linux/skbuff.h:2756 [inline] ip6erspan_rcv net/ipv6/ip6_gre.c:541 [inline] gre_rcv+0x11f8/0x1930 net/ipv6/ip6_gre.c:610 ip6_protocol_deliver_rcu+0x1d4c/0x2ca0 net/ipv6/ip6_input.c:438 ip6_input_finish net/ipv6/ip6_input.c:483 [inline] NF_HOOK include/linux/netfilter.h:314 [inline] ip6_input+0x15d/0x430 net/ipv6/ip6_input.c:492 ip6_mc_input+0xa7e/0xc80 net/ipv6/ip6_input.c:586 dst_input include/net/dst.h:460 [inline] ip6_rcv_finish+0x955/0x970 net/ipv6/ip6_input.c:79 NF_HOOK include/linux/netfilter.h:314 [inline] ipv6_rcv+0xde/0x390 net/ipv6/ip6_input.c:310 __netif_receive_skb_one_core net/core/dev.c:5538 [inline] __netif_receive_skb+0x1da/0xa00 net/core/dev.c:5652 netif_receive_skb_internal net/core/dev.c:5738 [inline] netif_receive_skb+0x58/0x660 net/core/dev.c:5798 tun_rx_batched+0x3ee/0x980 drivers/net/tun.c:1549 tun_get_user+0x5566/0x69e0 drivers/net/tun.c:2002 tun_chr_write_iter+0x3af/0x5d0 drivers/net/tun.c:2048 call_write_iter include/linux/fs.h:2108 [inline] new_sync_write fs/read_write.c:497 [inline] vfs_write+0xb63/0x1520 fs/read_write.c:590 ksys_write+0x20f/0x4c0 fs/read_write.c:643 __do_sys_write fs/read_write.c:655 [inline] __se_sys_write fs/read_write.c:652 [inline] __x64_sys_write+0x93/0xe0 fs/read_write.c:652 do_syscall_64+0xd5/0x1f0 entry_SYSCALL_64_after_hwframe+0x6d/0x75
Uninit was created at: slab_post_alloc_hook mm/slub.c:3804 [inline] slab_alloc_node mm/slub.c:3845 [inline] kmem_cache_alloc_node+0x613/0xc50 mm/slub.c:3888 kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:577 __alloc_skb+0x35b/0x7a0 net/core/skbuff.c:668 alloc_skb include/linux/skbuff.h:1318 [inline] alloc_skb_with_frags+0xc8/0xbf0 net/core/skbuff.c:6504 sock_alloc_send_pskb+0xa81/0xbf0 net/core/sock.c:2795 tun_alloc_skb drivers/net/tun.c:1525 [inline] tun_get_user+0x209a/0x69e0 drivers/net/tun.c:1846 tun_chr_write_iter+0x3af/0x5d0 drivers/net/tun.c:2048 call_write_iter include/linux/fs.h:2108 [inline] new_sync_write fs/read_write.c:497 [inline] vfs_write+0xb63/0x1520 fs/read_write.c:590 ksys_write+0x20f/0x4c0 fs/read_write.c:643 __do_sys_write fs/read_write.c:655 [inline] __se_sys_write fs/read_write.c:652 [inline] __x64_sys_write+0x93/0xe0 fs/read_write.c:652 do_syscall_64+0xd5/0x1f0 entry_SYSCALL_64_after_hwframe+0x6d/0x75
CPU: 1 PID: 5045 Comm: syz-executor114 Not tainted 6.9.0-rc1-syzkaller-00021-g962490525cff #0
CVSS Details
- CVSS 3.1 Base Score: 7.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-develUpgrade perfUpgrade kernel-rt-debug-develUpgrade kernel-debug-coreUpgrade kernel-rt-modulesUpgrade kernel-toolsUpgrade kernel-zfcpdumpUpgrade kernel-modulesUpgrade kernel-rtUpgrade kernel-zfcpdump-modulesUpgrade kernel-rt-debug-modulesUpgrade kernel-debug-modules-extraUpgrade kernel-docUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-modules-extraUpgrade kernel-rt-debug-modules-extraUpgrade kernel-zfcpdump-coreUpgrade kernel-rt-debugUpgrade kernel-coreUpgrade kernel-abi-stablelistsUpgrade kernel-tools-libsUpgrade kernel-rt-debug-coreUpgrade kernel-debug-modulesUpgrade kernelUpgrade kernel-rt-kvmUpgrade kernel-headersUpgrade kernel-tools-libs-develUpgrade kernel-rt-modules-extraUpgrade kernel-zfcpdump-develUpgrade kernel-cross-headersUpgrade kernel-rt-coreUpgrade kernel-debug-develUpgrade kernel-debugUpgrade bpftoolUpgrade kernel-rt-debug-kvmUpgrade python3-perfUpgrade kernel-rt-devel | Jul 3, 2024 | May 19, 2024 |
| Amazon Linux Ami 2 | — | Upgrade kernel-debuginfo-common-x86_64Upgrade kernelUpgrade kernel-develUpgrade kernel-tools-develUpgrade kernel-livepatch-5.10.215-203.850Upgrade python-perf-debuginfoUpgrade kernel-debuginfoUpgrade kernel-headersUpgrade kernel-tools-debuginfoUpgrade bpftoolUpgrade kernel-livepatch-5.15.156-102.160Upgrade kernel-toolsUpgrade kernel-debuginfo-common-aarch64Upgrade python-perfUpgrade bpftool-debuginfoUpgrade perf-debuginfoUpgrade perf | Apr 10, 2025 | May 19, 2024 |
| Amazon_linux_2023 | — | Upgrade kernel-toolsUpgrade bpftool-debuginfoUpgrade kernel-livepatch-6.1.87-99.174Upgrade kernelUpgrade kernel-libbpf-develUpgrade kernel-modules-extra-commonUpgrade kernel-headersUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-libbpf-staticUpgrade kernel-develUpgrade python3-perfUpgrade perf-debuginfoUpgrade kernel-tools-debuginfoUpgrade bpftoolUpgrade kernel-modules-extraUpgrade python3-perf-debuginfoUpgrade kernel-libbpfUpgrade kernel-debuginfoUpgrade kernel-tools-develUpgrade kernel-debuginfo-common-aarch64Upgrade perf | Feb 17, 2025 | May 19, 2024 |
| Debian | — | Upgrade linux | Jun 27, 2024 | May 19, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade kernel-tools-libsUpgrade python3-perfUpgrade kernel-abi-stablelistsUpgrade kernel-toolsUpgrade kernel | Oct 8, 2024 | May 19, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade python3-perfUpgrade kernel-abi-stablelistsUpgrade kernel-toolsUpgrade kernelUpgrade bpftoolUpgrade kernel-tools-libs | Oct 8, 2024 | May 19, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade kernelUpgrade kernel-abi-stablelistsUpgrade python3-perfUpgrade bpftoolUpgrade kernel-toolsUpgrade kernel-tools-libs | Oct 9, 2024 | May 19, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade python3-perfUpgrade kernelUpgrade kernel-tools-libsUpgrade kernel-tools | Oct 8, 2024 | May 19, 2024 |
| Oracle_linux | — | Upgrade kernel | Jul 3, 2024 | May 19, 2024 |
| Redhat_linux | — | Upgrade kernelUpgrade kernel-rtNo solution exists | Jul 3, 2024 | May 19, 2024 |
| Rocky_linux | — | Upgrade kernel-rt-modules-extraUpgrade kernel-toolsUpgrade kernel-develUpgrade kernel-rt-debug-debuginfoUpgrade bpftool-debuginfoUpgrade kernel-cross-headersUpgrade kernel-tools-libsUpgrade kernel-debug-debuginfoUpgrade python3-perf-debuginfoUpgrade kernel-rt-debugUpgrade kernel-rt-debuginfo-common-x86_64Upgrade kernel-rt-debug-modulesUpgrade kernel-debugUpgrade kernel-coreUpgrade kernel-debug-coreUpgrade kernel-debug-modulesUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-tools-debuginfoUpgrade bpftoolUpgrade kernel-rtUpgrade kernel-debug-modules-extraUpgrade kernel-debuginfoUpgrade kernel-rt-kvmUpgrade kernel-rt-coreUpgrade kernel-rt-debug-coreUpgrade kernel-modules-extraUpgrade kernel-rt-develUpgrade kernelUpgrade kernel-debug-develUpgrade kernel-rt-debug-modules-extraUpgrade kernel-rt-debug-develUpgrade perfUpgrade python3-perfUpgrade kernel-tools-libs-develUpgrade kernel-rt-debuginfoUpgrade perf-debuginfoUpgrade kernel-headersUpgrade kernel-rt-modulesUpgrade kernel-rt-debug-kvmUpgrade kernel-modules | Jul 16, 2024 | May 19, 2024 |
| Suse | — | Upgrade kernel-docsUpgrade cluster-md-kmp-rtUpgrade gfs2-kmp-defaultUpgrade dtb-freescaleUpgrade dtb-caviumUpgrade ocfs2-kmp-defaultUpgrade kernel-devel-rtUpgrade dtb-mediatekUpgrade kernel-default-optionalUpgrade dtb-appleUpgrade dtb-renesasUpgrade dtb-xilinxUpgrade kernel-debugUpgrade kernel-develUpgrade dtb-amdUpgrade kernel-default-livepatch-develUpgrade kselftests-kmp-defaultUpgrade dlm-kmp-azureUpgrade kernel-64kbUpgrade ocfs2-kmp-64kbUpgrade ocfs2-kmp-azureUpgrade kernel-default-livepatchUpgrade kernel-debug-develUpgrade kselftests-kmp-rtUpgrade cluster-md-kmp-64kbUpgrade kernel-rt_debugUpgrade kernel-64kb-extraUpgrade kernel-azure-extraUpgrade dtb-allwinnerUpgrade gfs2-kmp-azureUpgrade dlm-kmp-rtUpgrade kernel-64kb-develUpgrade kernel-symsUpgrade kernel-docs-htmlUpgrade reiserfs-kmp-rtUpgrade dtb-broadcomUpgrade dtb-marvellUpgrade dtb-sprdUpgrade kernel-defaultUpgrade kernel-source-vanillaUpgrade dtb-hisiliconUpgrade dlm-kmp-defaultUpgrade gfs2-kmp-64kbUpgrade kernel-rt-develUpgrade kernel-64kb-optionalUpgrade kernel-default-baseUpgrade kernel-default-develUpgrade reiserfs-kmp-defaultUpgrade dtb-socionextUpgrade dtb-amazonUpgrade kernel-kvmsmall-vdsoUpgrade kernel-kvmsmall-develUpgrade dtb-lgUpgrade kernel-debug-vdsoUpgrade kernel-rt-optionalUpgrade dtb-alteraUpgrade kselftests-kmp-azureUpgrade kernel-rtUpgrade kernel-rt-livepatch-develUpgrade kernel-rt_debug-vdsoUpgrade kernel-rt-livepatchUpgrade kernel-obs-qaUpgrade kernel-obs-buildUpgrade dtb-armUpgrade kernel-rt-extraUpgrade kernel-zfcpdumpUpgrade kernel-rt_debug-develUpgrade kernel-azureUpgrade dtb-exynosUpgrade reiserfs-kmp-64kbUpgrade ocfs2-kmp-rtUpgrade cluster-md-kmp-azureUpgrade kernel-syms-azureUpgrade kernel-source-azureUpgrade kernel-sourceUpgrade dtb-qcomUpgrade kernel-macrosUpgrade kernel-devel-azureUpgrade dlm-kmp-64kbUpgrade kernel-default-vdsoUpgrade kernel-azure-optionalUpgrade kernel-kvmsmallUpgrade gfs2-kmp-rtUpgrade cluster-md-kmp-defaultUpgrade dtb-amlogicUpgrade kernel-source-rtUpgrade kernel-rt-vdsoUpgrade kselftests-kmp-64kbUpgrade dtb-rockchipUpgrade dtb-nvidiaUpgrade dtb-apmUpgrade kernel-syms-rtUpgrade kernel-azure-vdsoUpgrade kernel-default-extraUpgrade reiserfs-kmp-azureUpgrade kernel-azure-develUpgrade kernel-default-base-rebuild | Dec 5, 2025 | Dec 13, 2024 |
| Ubuntu | — | Upgrade linux-image-virtual-hwe-24.04Upgrade linux-image-aws-lts-20.04Upgrade linux-image-ibm-lts-20.04Upgrade linux-image-5.15.0-1064-gcpUpgrade linux-image-5.15.0-116-generic-64kUpgrade linux-image-azure-lts-22.04Upgrade linux-image-generic-lpaeUpgrade linux-image-ibm-classicUpgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-virtual-hwe-20.04Upgrade linux-image-genericUpgrade linux-image-5.4.0-1127-oracleUpgrade linux-image-lowlatencyUpgrade linux-image-5.15.0-1062-kvmUpgrade linux-image-oracle-lts-20.04Upgrade linux-image-gcpUpgrade linux-image-5.15.0-116-genericUpgrade linux-image-5.4.0-189-generic-lpaeUpgrade linux-image-snapdragon-hwe-18.04Upgrade linux-image-oem-osp1Upgrade linux-image-xilinx-zynqmpUpgrade linux-image-gkeUpgrade linux-image-ibmUpgrade linux-image-oem-20.04cUpgrade linux-image-raspiUpgrade linux-image-oracle-64kUpgrade linux-image-nvidiaUpgrade linux-image-gke-5.15Upgrade linux-image-intel-iotgUpgrade linux-image-5.15.0-1048-gkeopUpgrade linux-image-5.15.0-116-generic-lpaeUpgrade linux-image-6.8.0-1009-nvidia-64kUpgrade linux-image-5.15.0-1068-azure-fdeUpgrade linux-image-5.15.0-116-lowlatencyUpgrade linux-image-gkeop-5.4Upgrade linux-image-gkeopUpgrade linux-image-oem-24.04Upgrade linux-image-nvidia-64kUpgrade linux-image-6.8.0-1006-gkeUpgrade linux-image-5.4.0-189-lowlatencyUpgrade linux-image-oem-20.04bUpgrade linux-image-5.4.0-1132-gcpUpgrade linux-image-azure-fde-lts-22.04Upgrade linux-image-6.8.0-1008-oemUpgrade linux-image-generic-64kUpgrade linux-image-6.8.0-38-generic-64kUpgrade linux-image-oemUpgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-aws-lts-22.04Upgrade linux-image-azure-lts-20.04Upgrade linux-image-azureUpgrade linux-image-6.8.0-1010-gcpUpgrade linux-image-5.15.0-1060-intel-iotgUpgrade linux-image-oem-24.04aUpgrade linux-image-intelUpgrade linux-image-oem-20.04dUpgrade linux-image-5.15.0-1065-awsUpgrade linux-image-lowlatency-64kUpgrade linux-image-5.15.0-116-lowlatency-64kUpgrade linux-image-6.8.0-1011-awsUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-azure-cvmUpgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-virtual-hwe-18.04Upgrade linux-image-5.15.0-1035-xilinx-zynqmpUpgrade linux-image-5.4.0-1075-ibmUpgrade linux-image-generic-hwe-18.04Upgrade linux-image-5.15.0-1063-oracleUpgrade linux-image-5.4.0-1112-raspiUpgrade linux-image-azure-fdeUpgrade linux-image-5.15.0-1062-gkeUpgrade linux-image-6.8.0-1007-raspiUpgrade linux-image-6.8.0-1010-azure-fdeUpgrade linux-image-5.15.0-1058-ibmUpgrade linux-image-5.4.0-1047-xilinx-zynqmpUpgrade linux-image-bluefieldUpgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-raspi-hwe-18.04Upgrade linux-image-5.4.0-189-genericUpgrade linux-image-6.8.0-38-lowlatency-64kUpgrade linux-image-6.8.0-1007-intelUpgrade linux-image-oem-20.04Upgrade linux-image-gcp-lts-22.04Upgrade linux-image-5.4.0-1128-awsUpgrade linux-image-5.15.0-1065-gcpUpgrade linux-image-5.4.0-1095-gkeopUpgrade linux-image-virtualUpgrade linux-image-gcp-lts-20.04Upgrade linux-image-awsUpgrade linux-image-5.15.0-1060-nvidiaUpgrade linux-image-5.4.0-1116-kvmUpgrade linux-image-raspi2Upgrade linux-image-6.8.0-38-genericUpgrade linux-image-5.4.0-1133-azureUpgrade linux-image-6.8.0-1010-azureUpgrade linux-image-6.8.0-1008-ibmUpgrade linux-image-lowlatency-hwe-18.04Upgrade linux-image-5.15.0-1058-raspiUpgrade linux-image-6.8.0-38-lowlatencyUpgrade linux-image-6.8.0-1008-oracleUpgrade linux-image-5.15.0-1068-azureUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-generic-hwe-20.04Upgrade linux-image-6.8.0-1008-oracle-64kUpgrade linux-image-6.8.0-1009-nvidiaUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-raspi-nolpaeUpgrade linux-image-5.4.0-1088-bluefieldUpgrade linux-image-oracle-lts-22.04Upgrade linux-image-5.15.0-1060-nvidia-lowlatencyUpgrade linux-image-oracleUpgrade linux-image-gkeop-5.15Upgrade linux-image-kvmUpgrade linux-image-5.4.0-1040-iot | Jul 12, 2024 | May 19, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | May 19, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub