In the Linux kernel, the following vulnerability has been resolved:
ip6_tunnel: make sure to pull inner header in __ip6_tnl_rcv()
syzbot found __ip6_tnl_rcv() could access unitiliazed data [1].
Call pskb_inet_may_pull() to fix this, and initialize ipv6h variable after this call as it can change skb->head.
[1] BUG: KMSAN: uninit-value in __INET_ECN_decapsulate include/net/inet_ecn.h:253 [inline] BUG: KMSAN: uninit-value in INET_ECN_decapsulate include/net/inet_ecn.h:275 [inline] BUG: KMSAN: uninit-value in IP6_ECN_decapsulate+0x7df/0x1e50 include/net/inet_ecn.h:321 __INET_ECN_decapsulate include/net/inet_ecn.h:253 [inline] INET_ECN_decapsulate include/net/inet_ecn.h:275 [inline] IP6_ECN_decapsulate+0x7df/0x1e50 include/net/inet_ecn.h:321 ip6ip6_dscp_ecn_decapsulate+0x178/0x1b0 net/ipv6/ip6_tunnel.c:727 __ip6_tnl_rcv+0xd4e/0x1590 net/ipv6/ip6_tunnel.c:845 ip6_tnl_rcv+0xce/0x100 net/ipv6/ip6_tunnel.c:888 gre_rcv+0x143f/0x1870 ip6_protocol_deliver_rcu+0xda6/0x2a60 net/ipv6/ip6_input.c:438 ip6_input_finish net/ipv6/ip6_input.c:483 [inline] NF_HOOK include/linux/netfilter.h:314 [inline] ip6_input+0x15d/0x430 net/ipv6/ip6_input.c:492 ip6_mc_input+0xa7e/0xc80 net/ipv6/ip6_input.c:586 dst_input include/net/dst.h:461 [inline] ip6_rcv_finish+0x5db/0x870 net/ipv6/ip6_input.c:79 NF_HOOK include/linux/netfilter.h:314 [inline] ipv6_rcv+0xda/0x390 net/ipv6/ip6_input.c:310 __netif_receive_skb_one_core net/core/dev.c:5532 [inline] __netif_receive_skb+0x1a6/0x5a0 net/core/dev.c:5646 netif_receive_skb_internal net/core/dev.c:5732 [inline] netif_receive_skb+0x58/0x660 net/core/dev.c:5791 tun_rx_batched+0x3ee/0x980 drivers/net/tun.c:1555 tun_get_user+0x53af/0x66d0 drivers/net/tun.c:2002 tun_chr_write_iter+0x3af/0x5d0 drivers/net/tun.c:2048 call_write_iter include/linux/fs.h:2084 [inline] new_sync_write fs/read_write.c:497 [inline] vfs_write+0x786/0x1200 fs/read_write.c:590 ksys_write+0x20f/0x4c0 fs/read_write.c:643 __do_sys_write fs/read_write.c:655 [inline] __se_sys_write fs/read_write.c:652 [inline] __x64_sys_write+0x93/0xd0 fs/read_write.c:652 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0x6d/0x140 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b
Uninit was created at: slab_post_alloc_hook+0x129/0xa70 mm/slab.h:768 slab_alloc_node mm/slub.c:3478 [inline] kmem_cache_alloc_node+0x5e9/0xb10 mm/slub.c:3523 kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:560 __alloc_skb+0x318/0x740 net/core/skbuff.c:651 alloc_skb include/linux/skbuff.h:1286 [inline] alloc_skb_with_frags+0xc8/0xbd0 net/core/skbuff.c:6334 sock_alloc_send_pskb+0xa80/0xbf0 net/core/sock.c:2787 tun_alloc_skb drivers/net/tun.c:1531 [inline] tun_get_user+0x1e8a/0x66d0 drivers/net/tun.c:1846 tun_chr_write_iter+0x3af/0x5d0 drivers/net/tun.c:2048 call_write_iter include/linux/fs.h:2084 [inline] new_sync_write fs/read_write.c:497 [inline] vfs_write+0x786/0x1200 fs/read_write.c:590 ksys_write+0x20f/0x4c0 fs/read_write.c:643 __do_sys_write fs/read_write.c:655 [inline] __se_sys_write fs/read_write.c:652 [inline] __x64_sys_write+0x93/0xd0 fs/read_write.c:652 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0x6d/0x140 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b
CPU: 0 PID: 5034 Comm: syz-executor331 Not tainted 6.7.0-syzkaller-00562-g9f8413c4a66f #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023
CVSS Details
- CVSS 3.1 Base Score: 8.6
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade kernel-develUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-livepatch-5.15.149-99.161Upgrade bpftool-debuginfoUpgrade python-perfUpgrade kernel-tools-debuginfoUpgrade kernel-debuginfoUpgrade bpftoolUpgrade kernel-tools-develUpgrade kernel-livepatch-5.10.210-201.852Upgrade perf-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade python-perf-debuginfoUpgrade kernel-toolsUpgrade kernel-headersUpgrade perfUpgrade kernel | Jul 9, 2024 | Mar 18, 2024 |
| Amazon_linux_2023 | — | Upgrade kernel-libbpf-staticUpgrade kernelUpgrade kernel-debuginfoUpgrade bpftool-debuginfoUpgrade kernel-libbpf-develUpgrade kernel-modules-extra-commonUpgrade kernel-debuginfo-common-x86_64Upgrade perf-debuginfoUpgrade kernel-headersUpgrade kernel-modules-extraUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-toolsUpgrade kernel-livepatch-6.1.77-99.164Upgrade kernel-develUpgrade kernel-libbpfUpgrade python3-perf-debuginfoUpgrade kernel-tools-debuginfoUpgrade python3-perfUpgrade kernel-tools-develUpgrade perfUpgrade bpftool | Feb 17, 2025 | Mar 18, 2024 |
| Debian | — | Upgrade linux | May 8, 2024 | Mar 18, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade kernel-abi-stablelistsUpgrade kernelUpgrade kernel-tools-libsUpgrade kernel-toolsUpgrade python3-perf | Jul 16, 2024 | Mar 18, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade kernelUpgrade python3-perfUpgrade bpftoolUpgrade kernel-tools-libsUpgrade kernel-toolsUpgrade kernel-abi-stablelists | Jun 26, 2024 | Mar 18, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade kernelUpgrade kernel-abi-stablelistsUpgrade kernel-tools-libsUpgrade python3-perfUpgrade kernel-toolsUpgrade bpftool | Oct 8, 2024 | Mar 18, 2024 |
| Huawei Euleros 2_0_sp8 | — | Upgrade python3-perfUpgrade bpftoolUpgrade kernel-headersUpgrade kernel-tools-libsUpgrade kernelUpgrade kernel-develUpgrade python-perfUpgrade perfUpgrade kernel-tools | Jul 23, 2024 | Mar 18, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade python3-perfUpgrade kernel-tools-libsUpgrade kernelUpgrade kernel-tools | Jul 17, 2024 | Mar 18, 2024 |
| Redhat_linux | — | Upgrade kernelUpgrade kernel-rtNo solution exists | Dec 5, 2024 | Mar 18, 2024 |
| Suse | — | Upgrade kselftests-kmp-64kbUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-64kb-optionalUpgrade dtb-exynosUpgrade kernel-docsUpgrade dtb-allwinnerUpgrade dlm-kmp-64kbUpgrade kselftests-kmp-defaultUpgrade reiserfs-kmp-azureUpgrade ocfs2-kmp-rtUpgrade kernel-obs-qaUpgrade dtb-xilinxUpgrade dtb-hisiliconUpgrade kernel-default-vdsoUpgrade kernel-develUpgrade kernel-default-optionalUpgrade dtb-qcomUpgrade kernel-default-baseUpgrade kernel-debugUpgrade dtb-caviumUpgrade ocfs2-kmp-defaultUpgrade gfs2-kmp-rtUpgrade kernel-64kb-livepatch-develUpgrade dtb-mediatekUpgrade ocfs2-kmp-azureUpgrade kernel-devel-rtUpgrade dlm-kmp-azureUpgrade kernel-defaultUpgrade dtb-alteraUpgrade kernel-kvmsmall-develUpgrade cluster-md-kmp-azureUpgrade kernel-rt-livepatchUpgrade kernel-debug-develUpgrade dtb-renesasUpgrade dtb-armUpgrade cluster-md-kmp-rtUpgrade kernel-zfcpdumpUpgrade kernel-symsUpgrade kernel-default-extraUpgrade dtb-apmUpgrade dtb-amdUpgrade kernel-sourceUpgrade kernel-rt-develUpgrade reiserfs-kmp-defaultUpgrade kernel-64kb-develUpgrade gfs2-kmp-64kbUpgrade kernel-default-livepatch-develUpgrade gfs2-kmp-azureUpgrade dtb-rockchipUpgrade kernel-azure-develUpgrade kernel-source-vanillaUpgrade dlm-kmp-rtUpgrade reiserfs-kmp-rtUpgrade dtb-amazonUpgrade dtb-freescaleUpgrade kernel-docs-htmlUpgrade cluster-md-kmp-64kbUpgrade dtb-sprdUpgrade kernel-source-rtUpgrade kernel-debug-livepatch-develUpgrade kernel-syms-azureUpgrade kernel-devel-azureUpgrade kernel-rt_debug-develUpgrade dtb-nvidiaUpgrade kernel-azure-extraUpgrade kernel-default-manUpgrade kernel-azure-livepatch-develUpgrade dtb-marvellUpgrade kernel-default-base-rebuildUpgrade kselftests-kmp-rtUpgrade kernel-rt_debug-vdsoUpgrade kernel-macrosUpgrade kernel-rt-extraUpgrade kernel-rt-vdsoUpgrade dlm-kmp-defaultUpgrade kernel-azureUpgrade kernel-64kbUpgrade kselftests-kmp-azureUpgrade kernel-azure-optionalUpgrade dtb-appleUpgrade kernel-kvmsmallUpgrade kernel-rt_debugUpgrade cluster-md-kmp-defaultUpgrade dtb-broadcomUpgrade kernel-rt-optionalUpgrade dtb-socionextUpgrade kernel-rt-livepatch-develUpgrade kernel-debug-vdsoUpgrade kernel-default-livepatchUpgrade kernel-azure-vdsoUpgrade kernel-64kb-extraUpgrade kernel-kvmsmall-livepatch-develUpgrade dtb-lgUpgrade ocfs2-kmp-64kbUpgrade kernel-azure-baseUpgrade dtb-amlogicUpgrade kernel-source-azureUpgrade kernel-rtUpgrade kernel-default-develUpgrade reiserfs-kmp-64kbUpgrade kernel-obs-buildUpgrade kernel-syms-rtUpgrade kernel-kvmsmall-vdsoUpgrade gfs2-kmp-default | Jul 10, 2024 | Mar 18, 2024 |
| Ubuntu | — | Upgrade linux-image-5.15.0-1057-intel-iotgUpgrade linux-image-gkeUpgrade linux-image-oem-osp1Upgrade linux-image-generic-hwe-22.04Upgrade linux-image-4.15.0-1157-kvmUpgrade linux-image-5.15.0-106-genericUpgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-virtual-hwe-18.04Upgrade linux-image-oracle-lts-18.04Upgrade linux-image-6.5.0-1021-nvidiaUpgrade linux-image-oracleUpgrade linux-image-5.15.0-1058-intel-iotgUpgrade linux-image-5.4.0-1134-oracleUpgrade linux-image-xilinx-zynqmpUpgrade linux-image-generic-hwe-18.04Upgrade linux-image-lowlatency-hwe-16.04Upgrade linux-image-generic-hwe-20.04Upgrade linux-image-nvidia-64k-6.5Upgrade linux-image-4.15.0-1182-azureUpgrade linux-image-5.15.0-1059-oracleUpgrade linux-image-5.15.0-1058-gkeUpgrade linux-image-5.15.0-1054-raspiUpgrade linux-image-gkeop-5.15Upgrade linux-image-raspi-hwe-18.04Upgrade linux-image-azure-cvmUpgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-5.4.0-1094-bluefieldUpgrade linux-image-laptop-23.10Upgrade linux-image-5.15.0-1054-ibmUpgrade linux-image-oem-20.04Upgrade linux-image-5.4.0-1139-azureUpgrade linux-image-5.15.0-1063-azure-fdeUpgrade linux-image-oracle-64kUpgrade linux-image-5.15.0-1063-azureUpgrade linux-image-bluefieldUpgrade linux-image-oem-20.04dUpgrade linux-image-virtual-hwe-20.04Upgrade linux-image-5.4.0-1102-gkeopUpgrade linux-image-6.5.0-1022-azureUpgrade linux-image-kvmUpgrade linux-image-5.15.0-1044-gkeopUpgrade linux-image-oem-22.04dUpgrade linux-image-oemUpgrade linux-image-6.5.0-41-generic-64kUpgrade linux-image-6.5.0-1024-oemUpgrade linux-image-oem-22.04bUpgrade linux-image-aws-lts-18.04Upgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-5.4.0-1082-ibmUpgrade linux-image-5.15.0-1058-kvmUpgrade linux-image-6.5.0-1022-gcpUpgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-5.4.0-1119-raspiUpgrade linux-image-generic-hwe-16.04Upgrade linux-image-oracle-lts-22.04Upgrade linux-image-raspi-nolpaeUpgrade linux-image-5.15.0-1054-nvidiaUpgrade linux-image-5.4.0-200-lowlatencyUpgrade linux-image-6.5.0-1018-raspiUpgrade linux-image-lowlatency-hwe-18.04Upgrade linux-image-virtual-hwe-22.04Upgrade linux-image-virtualUpgrade linux-image-5.15.0-106-lowlatency-64kUpgrade linux-image-5.15.0-106-generic-64kUpgrade linux-image-awsUpgrade linux-image-5.4.0-200-generic-lpaeUpgrade linux-image-gkeopUpgrade linux-image-generic-64kUpgrade linux-image-4.15.0-1167-gcpUpgrade linux-image-gcpUpgrade linux-image-5.4.0-1054-xilinx-zynqmpUpgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-5.4.0-1123-kvmUpgrade linux-image-6.5.0-41-lowlatencyUpgrade linux-image-4.15.0-1174-awsUpgrade linux-image-5.4.0-1044-iotUpgrade linux-image-azure-fdeUpgrade linux-image-5.4.0-1140-azureUpgrade linux-image-raspi2Upgrade linux-image-gcp-lts-22.04Upgrade linux-image-nvidia-lowlatencyUpgrade linux-image-oracle-lts-20.04Upgrade linux-image-6.5.0-1024-oracleUpgrade linux-image-generic-lpaeUpgrade linux-image-genericUpgrade linux-image-5.15.0-106-generic-lpaeUpgrade linux-image-4.15.0-1136-oracleUpgrade linux-image-oem-22.04Upgrade linux-image-virtual-hwe-16.04Upgrade linux-image-snapdragon-hwe-18.04Upgrade linux-image-oem-20.04bUpgrade linux-image-6.5.0-41-genericUpgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-gkeop-5.4Upgrade linux-image-5.4.0-200-genericUpgrade linux-image-aws-hweUpgrade linux-image-5.15.0-1061-awsUpgrade linux-image-5.4.0-1135-awsUpgrade linux-image-oem-22.04aUpgrade linux-image-6.5.0-1021-awsUpgrade linux-image-5.4.0-1139-gcpUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-oem-22.04cUpgrade linux-image-5.15.0-1054-nvidia-lowlatencyUpgrade linux-image-lowlatency-64kUpgrade linux-image-intel-iotgUpgrade linux-image-6.5.0-41-lowlatency-64kUpgrade linux-image-ibmUpgrade linux-image-gcp-lts-20.04Upgrade linux-image-gcp-lts-18.04Upgrade linux-image-6.5.0-1024-oracle-64kUpgrade linux-image-6.5.0-1021-nvidia-64kUpgrade linux-image-6.5.0-1022-azure-fdeUpgrade linux-image-raspiUpgrade linux-image-azure-lts-18.04Upgrade linux-image-5.15.0-1059-gcpUpgrade linux-image-azureUpgrade linux-image-lowlatencyUpgrade linux-image-ibm-lts-20.04Upgrade linux-image-4.15.0-230-genericUpgrade linux-image-gke-5.15Upgrade linux-image-nvidia-6.5Upgrade linux-image-nvidiaUpgrade linux-image-4.15.0-230-lowlatencyUpgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-aws-lts-22.04Upgrade linux-image-6.5.0-1015-starfiveUpgrade linux-image-5.15.0-106-lowlatencyUpgrade linux-image-azure-fde-lts-22.04Upgrade linux-image-aws-lts-20.04Upgrade linux-image-starfiveUpgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-azure-lts-20.04Upgrade linux-image-6.5.0-1017-laptopUpgrade linux-image-intelUpgrade linux-image-oem-20.04cUpgrade linux-image-azure-lts-22.04 | May 17, 2024 | Mar 18, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Mar 18, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub