In the Linux kernel, the following vulnerability has been resolved:
net: validate lwtstate->data before returning from skb_tunnel_info()
skb_tunnel_info() returns pointer of lwtstate->data as ip_tunnel_info type without validation. lwtstate->data can have various types such as mpls_iptunnel_encap, etc and these are not compatible. So skb_tunnel_info() should validate before returning that pointer.
Splat looks like: BUG: KASAN: slab-out-of-bounds in vxlan_get_route+0x418/0x4b0 [vxlan] Read of size 2 at addr ffff888106ec2698 by task ping/811
CPU: 1 PID: 811 Comm: ping Not tainted 5.13.0+ #1195 Call Trace: dump_stack_lvl+0x56/0x7b print_address_description.constprop.8.cold.13+0x13/0x2ee ? vxlan_get_route+0x418/0x4b0 [vxlan] ? vxlan_get_route+0x418/0x4b0 [vxlan] kasan_report.cold.14+0x83/0xdf ? vxlan_get_route+0x418/0x4b0 [vxlan] vxlan_get_route+0x418/0x4b0 [vxlan] [ ... ] vxlan_xmit_one+0x148b/0x32b0 [vxlan] [ ... ] vxlan_xmit+0x25c5/0x4780 [vxlan] [ ... ] dev_hard_start_xmit+0x1ae/0x6e0 __dev_queue_xmit+0x1f39/0x31a0 [ ... ] neigh_xmit+0x2f9/0x940 mpls_xmit+0x911/0x1600 [mpls_iptunnel] lwtunnel_xmit+0x18f/0x450 ip_finish_output2+0x867/0x2040 [ ... ]
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade python-perfUpgrade kernel-livepatch-5.10.59-52.142Upgrade bpftool-debuginfoUpgrade python-perf-debuginfoUpgrade kernel-toolsUpgrade kernel-headersUpgrade kernel-debuginfo-common-x86_64Upgrade kernelUpgrade perf-debuginfoUpgrade kernel-livepatch-4.14.241-184.433Upgrade kernel-debuginfoUpgrade kernel-tools-develUpgrade kernel-develUpgrade perfUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-tools-debuginfoUpgrade bpftool | Mar 3, 2025 | May 21, 2024 |
| Amazon_linux | — | Upgrade kernel | Mar 2, 2025 | Oct 5, 2021 |
| Debian | — | Upgrade linux | Jul 30, 2024 | May 21, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | May 21, 2024 |
| Suse | — | Upgrade kernel-default-baseUpgrade kernel-azureUpgrade kernel-azure-baseUpgrade kernel-default-manUpgrade kernel-obs-buildUpgrade kernel-azure-develUpgrade kernel-source-azureUpgrade kernel-defaultUpgrade kernel-docsUpgrade kernel-default-develUpgrade kernel-devel-azureUpgrade kernel-sourceUpgrade kernel-macrosUpgrade kernel-symsUpgrade kernel-default-extraUpgrade kernel-syms-azureUpgrade kernel-devel | Aug 9, 2024 | May 21, 2024 |
| Ubuntu | — | Upgrade linux-aws-fipsUpgrade linux-kvmUpgrade linux-azure-5.4Upgrade linux-azure-4.15Upgrade linux-oracleUpgrade linux-gkeopUpgrade linux-gcp-fipsUpgrade linux-gcp-4.15Upgrade linux-raspi-5.4Upgrade linux-bluefieldUpgrade linux-awsUpgrade linux-ibmUpgrade linux-hweUpgrade linux-gcpUpgrade linux-azureUpgrade linux-hwe-5.4Upgrade linux-gcp-5.4Upgrade linux-oracle-5.4Upgrade linux-aws-hweUpgrade linux-aws-5.4Upgrade linux-raspiUpgrade linuxUpgrade linux-fipsUpgrade linux-azure-fips | Nov 19, 2024 | May 21, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub