In the Linux kernel, the following vulnerability has been resolved:
net: validate lwtstate->data before returning from skb_tunnel_info()
skb_tunnel_info() returns pointer of lwtstate->data as ip_tunnel_info type without validation. lwtstate->data can have various types such as mpls_iptunnel_encap, etc and these are not compatible. So skb_tunnel_info() should validate before returning that pointer.
Splat looks like: BUG: KASAN: slab-out-of-bounds in vxlan_get_route+0x418/0x4b0 [vxlan] Read of size 2 at addr ffff888106ec2698 by task ping/811
CPU: 1 PID: 811 Comm: ping Not tainted 5.13.0+ #1195 Call Trace: dump_stack_lvl+0x56/0x7b print_address_description.constprop.8.cold.13+0x13/0x2ee ? vxlan_get_route+0x418/0x4b0 [vxlan] ? vxlan_get_route+0x418/0x4b0 [vxlan] kasan_report.cold.14+0x83/0xdf ? vxlan_get_route+0x418/0x4b0 [vxlan] vxlan_get_route+0x418/0x4b0 [vxlan] [ ... ] vxlan_xmit_one+0x148b/0x32b0 [vxlan] [ ... ] vxlan_xmit+0x25c5/0x4780 [vxlan] [ ... ] dev_hard_start_xmit+0x1ae/0x6e0 __dev_queue_xmit+0x1f39/0x31a0 [ ... ] neigh_xmit+0x2f9/0x940 mpls_xmit+0x911/0x1600 [mpls_iptunnel] lwtunnel_xmit+0x18f/0x450 ip_finish_output2+0x867/0x2040 [ ... ]
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade kernel-tools-develUpgrade kernel-tools-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade bpftoolUpgrade perfUpgrade kernel-develUpgrade kernel-debuginfoUpgrade kernel-livepatch-4.14.241-184.433Upgrade kernel-toolsUpgrade kernel-livepatch-5.10.59-52.142Upgrade perf-debuginfoUpgrade python-perf-debuginfoUpgrade kernelUpgrade python-perfUpgrade bpftool-debuginfoUpgrade kernel-headersUpgrade kernel-debuginfo-common-x86_64 | Mar 3, 2025 | May 21, 2024 |
| Amazon_linux | — | Upgrade kernel | Mar 2, 2025 | Oct 5, 2021 |
| Debian | — | Upgrade linux | Jul 30, 2024 | May 21, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | May 21, 2024 |
| Suse | — | Upgrade kernel-azure-develUpgrade kernel-azure-baseUpgrade kernel-defaultUpgrade kernel-source-azureUpgrade kernel-obs-buildUpgrade kernel-default-baseUpgrade kernel-default-manUpgrade kernel-azureUpgrade kernel-syms-azureUpgrade kernel-default-extraUpgrade kernel-sourceUpgrade kernel-docsUpgrade kernel-macrosUpgrade kernel-symsUpgrade kernel-devel-azureUpgrade kernel-default-develUpgrade kernel-devel | Aug 9, 2024 | May 21, 2024 |
| Ubuntu | — | Upgrade linux-aws-hweUpgrade linux-azure-fipsUpgrade linux-fipsUpgrade linux-oracle-5.4Upgrade linux-raspiUpgrade linux-aws-5.4Upgrade linuxUpgrade linux-azure-5.4Upgrade linux-azure-4.15Upgrade linux-hweUpgrade linux-bluefieldUpgrade linux-hwe-5.4Upgrade linux-aws-fipsUpgrade linux-azureUpgrade linux-oracleUpgrade linux-awsUpgrade linux-kvmUpgrade linux-gcp-5.4Upgrade linux-ibmUpgrade linux-raspi-5.4Upgrade linux-gcpUpgrade linux-gcp-fipsUpgrade linux-gkeopUpgrade linux-gcp-4.15 | Nov 19, 2024 | May 21, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub