In the Linux kernel, the following vulnerability has been resolved:
ipv6: sr: fix out-of-bounds read when setting HMAC data.
The SRv6 layer allows defining HMAC data that can later be used to sign IPv6 Segment Routing Headers. This configuration is realised via netlink through four attributes: SEG6_ATTR_HMACKEYID, SEG6_ATTR_SECRET, SEG6_ATTR_SECRETLEN and SEG6_ATTR_ALGID. Because the SECRETLEN attribute is decoupled from the actual length of the SECRET attribute, it is possible to provide invalid combinations (e.g., secret = "", secretlen = 64). This case is not checked in the code and with an appropriately crafted netlink message, an out-of-bounds read of up to 64 bytes (max secret length) can occur past the skb end pointer and into skb_shared_info:
Breakpoint 1, seg6_genl_sethmac (skb=<optimized out>, info=<optimized out>) at net/ipv6/seg6.c:208 208 memcpy(hinfo->secret, secret, slen); (gdb) bt #0 seg6_genl_sethmac (skb=<optimized out>, info=<optimized out>) at net/ipv6/seg6.c:208 #1 0xffffffff81e012e9 in genl_family_rcv_msg_doit (skb=skb@entry=0xffff88800b1f9f00, nlh=nlh@entry=0xffff88800b1b7600, extack=extack@entry=0xffffc90000ba7af0, ops=ops@entry=0xffffc90000ba7a80, hdrlen=4, net=0xffffffff84237580 <init_net>, family=<optimized out>, family=<optimized out>) at net/netlink/genetlink.c:731 #2 0xffffffff81e01435 in genl_family_rcv_msg (extack=0xffffc90000ba7af0, nlh=0xffff88800b1b7600, skb=0xffff88800b1f9f00, family=0xffffffff82fef6c0 <seg6_genl_family>) at net/netlink/genetlink.c:775 #3 genl_rcv_msg (skb=0xffff88800b1f9f00, nlh=0xffff88800b1b7600, extack=0xffffc90000ba7af0) at net/netlink/genetlink.c:792 #4 0xffffffff81dfffc3 in netlink_rcv_skb (skb=skb@entry=0xffff88800b1f9f00, cb=cb@entry=0xffffffff81e01350 <genl_rcv_msg>) at net/netlink/af_netlink.c:2501 #5 0xffffffff81e00919 in genl_rcv (skb=0xffff88800b1f9f00) at net/netlink/genetlink.c:803 #6 0xffffffff81dff6ae in netlink_unicast_kernel (ssk=0xffff888010eec800, skb=0xffff88800b1f9f00, sk=0xffff888004aed000) at net/netlink/af_netlink.c:1319 #7 netlink_unicast (ssk=ssk@entry=0xffff888010eec800, skb=skb@entry=0xffff88800b1f9f00, portid=portid@entry=0, nonblock=<optimized out>) at net/netlink/af_netlink.c:1345 #8 0xffffffff81dff9a4 in netlink_sendmsg (sock=<optimized out>, msg=0xffffc90000ba7e48, len=<optimized out>) at net/netlink/af_netlink.c:1921 ... (gdb) p/x ((struct sk_buff *)0xffff88800b1f9f00)->head + ((struct sk_buff *)0xffff88800b1f9f00)->end $1 = 0xffff88800b1b76c0 (gdb) p/x secret $2 = 0xffff88800b1b76c0 (gdb) p slen $3 = 64 '@'
The OOB data can then be read back from userspace by dumping HMAC state. This commit fixes this by ensuring SECRETLEN cannot exceed the actual length of SECRET.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade kernel-tools-develUpgrade kernel-debuginfo-common-aarch64Upgrade python-perf-debuginfoUpgrade kernel-livepatch-5.10.144-127.601Upgrade perf-debuginfoUpgrade kernel-headersUpgrade perfUpgrade kernel-livepatch-4.14.294-220.533Upgrade kernel-toolsUpgrade bpftoolUpgrade bpftool-debuginfoUpgrade kernel-develUpgrade kernel-livepatch-5.15.69-37.134Upgrade python-perfUpgrade kernel-tools-debuginfoUpgrade kernelUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-debuginfo | Jun 11, 2024 | May 3, 2024 |
| Amazon_linux | — | Upgrade kernel | Jun 7, 2024 | Oct 11, 2022 |
| Debian | — | Upgrade linux | Jul 30, 2024 | May 3, 2024 |
| Dell Powerstore Dsa2024408 | — | Upgrade Dell PowerStoreOS to the latest version | Jan 13, 2026 | Sep 26, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | May 3, 2024 |
| Suse | — | Upgrade reiserfs-kmp-64kbUpgrade ocfs2-kmp-64kbUpgrade dtb-alteraUpgrade kernel-kvmsmall-develUpgrade kernel-sourceUpgrade kernel-azure-vdsoUpgrade kernel-rt_debugUpgrade kernel-source-azureUpgrade kernel-default-livepatchUpgrade dtb-socionextUpgrade kernel-rt-extraUpgrade kernel-azure-baseUpgrade kernel-rt-livepatch-develUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-rt-vdsoUpgrade gfs2-kmp-azureUpgrade kernel-syms-azureUpgrade kernel-source-vanillaUpgrade dtb-exynosUpgrade kernel-azure-develUpgrade kernel-preempt-develUpgrade kernel-kvmsmall-vdsoUpgrade kernel-64kbUpgrade kernel-default-vdsoUpgrade kselftests-kmp-azureUpgrade dtb-caviumUpgrade kernel-obs-buildUpgrade kernel-azureUpgrade dtb-sprdUpgrade kernel-rt_debug-develUpgrade dtb-broadcomUpgrade dtb-amdUpgrade kernel-rt-optionalUpgrade kernel-docs-htmlUpgrade kernel-64kb-optionalUpgrade cluster-md-kmp-azureUpgrade gfs2-kmp-defaultUpgrade kernel-debug-develUpgrade dtb-appleUpgrade dlm-kmp-64kbUpgrade dtb-amazonUpgrade dtb-renesasUpgrade kernel-azure-extraUpgrade kernel-debug-vdsoUpgrade cluster-md-kmp-64kbUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-default-develUpgrade reiserfs-kmp-rtUpgrade kernel-devel-azureUpgrade dtb-lgUpgrade kernel-azure-optionalUpgrade kernel-source-rtUpgrade kernel-default-livepatch-develUpgrade dtb-freescaleUpgrade ocfs2-kmp-defaultUpgrade kernel-64kb-extraUpgrade kselftests-kmp-64kbUpgrade dtb-marvellUpgrade kernel-default-manUpgrade dtb-allwinnerUpgrade cluster-md-kmp-rtUpgrade kernel-debugUpgrade dtb-amlogicUpgrade kernel-rtUpgrade dtb-xilinxUpgrade kernel-defaultUpgrade kernel-default-extraUpgrade kernel-docsUpgrade dtb-qcomUpgrade dlm-kmp-defaultUpgrade dtb-rockchipUpgrade kernel-default-base-rebuildUpgrade kernel-rt-develUpgrade kernel-syms-rtUpgrade dtb-armUpgrade dtb-nvidiaUpgrade dtb-apmUpgrade ocfs2-kmp-rtUpgrade kselftests-kmp-defaultUpgrade kernel-zfcpdumpUpgrade kernel-rt_debug-vdsoUpgrade kernel-rt-livepatchUpgrade kernel-azure-livepatch-develUpgrade kernel-64kb-livepatch-develUpgrade cluster-md-kmp-defaultUpgrade dtb-hisiliconUpgrade kernel-kvmsmallUpgrade kernel-preemptUpgrade kernel-default-optionalUpgrade kernel-64kb-develUpgrade dlm-kmp-rtUpgrade kernel-macrosUpgrade kernel-develUpgrade kernel-debug-livepatch-develUpgrade kernel-devel-rtUpgrade ocfs2-kmp-azureUpgrade reiserfs-kmp-azureUpgrade dlm-kmp-azureUpgrade reiserfs-kmp-defaultUpgrade kernel-symsUpgrade kernel-default-baseUpgrade dtb-mediatekUpgrade kselftests-kmp-rtUpgrade kernel-obs-qaUpgrade gfs2-kmp-rtUpgrade gfs2-kmp-64kb | Aug 9, 2024 | May 3, 2024 |
| Ubuntu | — | Upgrade linux-intel-iotgUpgrade linux-ibmUpgrade linux-oracleUpgrade linux-aws-fipsUpgrade linux-realtimeUpgrade linux-azureUpgrade linux-azure-5.15Upgrade linux-azure-5.4Upgrade linux-riscv-5.15Upgrade linux-intel-iotg-5.15Upgrade linux-aws-hweUpgrade linux-azure-fdeUpgrade linux-gcp-fipsUpgrade linux-hwe-5.15Upgrade linux-hwe-5.4Upgrade linux-hweUpgrade linux-gkeop-5.15Upgrade linux-nvidiaUpgrade linux-raspi-5.4Upgrade linux-bluefieldUpgrade linux-fipsUpgrade linux-gcp-4.15Upgrade linux-gcp-5.15Upgrade linux-iotUpgrade linux-azure-4.15Upgrade linux-gkeopUpgrade linux-kvmUpgrade linux-oracle-5.15Upgrade linux-lowlatency-hwe-5.15Upgrade linux-raspiUpgrade linux-ibm-5.4Upgrade linux-gcp-5.4Upgrade linuxUpgrade linux-gcpUpgrade linux-awsUpgrade linux-aws-5.15Upgrade linux-oracle-5.4Upgrade linux-gkeUpgrade linux-aws-5.4Upgrade linux-azure-fipsUpgrade linux-lowlatency | Nov 19, 2024 | May 3, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | May 3, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub