In the Linux kernel, the following vulnerability has been resolved:
net: validate lwtstate->data before returning from skb_tunnel_info()
skb_tunnel_info() returns pointer of lwtstate->data as ip_tunnel_info type without validation. lwtstate->data can have various types such as mpls_iptunnel_encap, etc and these are not compatible. So skb_tunnel_info() should validate before returning that pointer.
Splat looks like: BUG: KASAN: slab-out-of-bounds in vxlan_get_route+0x418/0x4b0 [vxlan] Read of size 2 at addr ffff888106ec2698 by task ping/811
CPU: 1 PID: 811 Comm: ping Not tainted 5.13.0+ #1195 Call Trace: dump_stack_lvl+0x56/0x7b print_address_description.constprop.8.cold.13+0x13/0x2ee ? vxlan_get_route+0x418/0x4b0 [vxlan] ? vxlan_get_route+0x418/0x4b0 [vxlan] kasan_report.cold.14+0x83/0xdf ? vxlan_get_route+0x418/0x4b0 [vxlan] vxlan_get_route+0x418/0x4b0 [vxlan] [ ... ] vxlan_xmit_one+0x148b/0x32b0 [vxlan] [ ... ] vxlan_xmit+0x25c5/0x4780 [vxlan] [ ... ] dev_hard_start_xmit+0x1ae/0x6e0 __dev_queue_xmit+0x1f39/0x31a0 [ ... ] neigh_xmit+0x2f9/0x940 mpls_xmit+0x911/0x1600 [mpls_iptunnel] lwtunnel_xmit+0x18f/0x450 ip_finish_output2+0x867/0x2040 [ ... ]
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade bpftoolUpgrade kernel-tools-develUpgrade kernel-livepatch-4.14.241-184.433Upgrade kernel-debuginfoUpgrade kernel-tools-debuginfoUpgrade perfUpgrade kernel-develUpgrade kernel-debuginfo-common-aarch64Upgrade kernelUpgrade kernel-headersUpgrade kernel-toolsUpgrade kernel-livepatch-5.10.59-52.142Upgrade python-perf-debuginfoUpgrade perf-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade python-perfUpgrade bpftool-debuginfo | Mar 3, 2025 | May 21, 2024 |
| Amazon_linux | — | Upgrade kernel | Mar 2, 2025 | Oct 5, 2021 |
| Debian | — | Upgrade linux | Jul 30, 2024 | May 21, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | May 21, 2024 |
| Suse | — | Upgrade kernel-sourceUpgrade kernel-docsUpgrade kernel-default-extraUpgrade kernel-syms-azureUpgrade kernel-macrosUpgrade kernel-develUpgrade kernel-devel-azureUpgrade kernel-default-develUpgrade kernel-symsUpgrade kernel-default-manUpgrade kernel-azure-develUpgrade kernel-source-azureUpgrade kernel-obs-buildUpgrade kernel-default-baseUpgrade kernel-defaultUpgrade kernel-azure-baseUpgrade kernel-azure | Aug 9, 2024 | May 21, 2024 |
| Ubuntu | — | Upgrade linux-fipsUpgrade linux-aws-5.4Upgrade linuxUpgrade linux-raspiUpgrade linux-azure-fipsUpgrade linux-aws-hweUpgrade linux-oracle-5.4Upgrade linux-gkeopUpgrade linux-bluefieldUpgrade linux-gcpUpgrade linux-oracleUpgrade linux-gcp-fipsUpgrade linux-kvmUpgrade linux-gcp-4.15Upgrade linux-ibmUpgrade linux-hweUpgrade linux-raspi-5.4Upgrade linux-awsUpgrade linux-aws-fipsUpgrade linux-hwe-5.4Upgrade linux-azure-5.4Upgrade linux-azureUpgrade linux-gcp-5.4Upgrade linux-azure-4.15 | Nov 19, 2024 | May 21, 2024 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub