In the Linux kernel, the following vulnerability has been resolved:
net: validate lwtstate->data before returning from skb_tunnel_info()
skb_tunnel_info() returns pointer of lwtstate->data as ip_tunnel_info type without validation. lwtstate->data can have various types such as mpls_iptunnel_encap, etc and these are not compatible. So skb_tunnel_info() should validate before returning that pointer.
Splat looks like: BUG: KASAN: slab-out-of-bounds in vxlan_get_route+0x418/0x4b0 [vxlan] Read of size 2 at addr ffff888106ec2698 by task ping/811
CPU: 1 PID: 811 Comm: ping Not tainted 5.13.0+ #1195 Call Trace: dump_stack_lvl+0x56/0x7b print_address_description.constprop.8.cold.13+0x13/0x2ee ? vxlan_get_route+0x418/0x4b0 [vxlan] ? vxlan_get_route+0x418/0x4b0 [vxlan] kasan_report.cold.14+0x83/0xdf ? vxlan_get_route+0x418/0x4b0 [vxlan] vxlan_get_route+0x418/0x4b0 [vxlan] [ ... ] vxlan_xmit_one+0x148b/0x32b0 [vxlan] [ ... ] vxlan_xmit+0x25c5/0x4780 [vxlan] [ ... ] dev_hard_start_xmit+0x1ae/0x6e0 __dev_queue_xmit+0x1f39/0x31a0 [ ... ] neigh_xmit+0x2f9/0x940 mpls_xmit+0x911/0x1600 [mpls_iptunnel] lwtunnel_xmit+0x18f/0x450 ip_finish_output2+0x867/0x2040 [ ... ]
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade kernel-debuginfo-common-x86_64Upgrade kernel-headersUpgrade kernel-livepatch-5.10.59-52.142Upgrade kernel-toolsUpgrade kernelUpgrade python-perfUpgrade perf-debuginfoUpgrade python-perf-debuginfoUpgrade bpftool-debuginfoUpgrade kernel-tools-debuginfoUpgrade kernel-develUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-tools-develUpgrade kernel-debuginfoUpgrade kernel-livepatch-4.14.241-184.433Upgrade bpftoolUpgrade perf | Mar 3, 2025 | May 21, 2024 |
| Amazon_linux | — | Upgrade kernel | Mar 2, 2025 | Oct 5, 2021 |
| Debian | — | Upgrade linux | Jul 30, 2024 | May 21, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | May 21, 2024 |
| Suse | — | Upgrade kernel-obs-buildUpgrade kernel-source-azureUpgrade kernel-azureUpgrade kernel-defaultUpgrade kernel-azure-baseUpgrade kernel-default-manUpgrade kernel-azure-develUpgrade kernel-default-baseUpgrade kernel-docsUpgrade kernel-develUpgrade kernel-symsUpgrade kernel-macrosUpgrade kernel-sourceUpgrade kernel-default-extraUpgrade kernel-syms-azureUpgrade kernel-devel-azureUpgrade kernel-default-devel | Aug 9, 2024 | May 21, 2024 |
| Ubuntu | — | Upgrade linuxUpgrade linux-oracle-5.4Upgrade linux-fipsUpgrade linux-raspiUpgrade linux-aws-5.4Upgrade linux-azure-fipsUpgrade linux-aws-hweUpgrade linux-azure-5.4Upgrade linux-gcp-5.4Upgrade linux-kvmUpgrade linux-bluefieldUpgrade linux-gcp-fipsUpgrade linux-hweUpgrade linux-awsUpgrade linux-gcpUpgrade linux-oracleUpgrade linux-hwe-5.4Upgrade linux-aws-fipsUpgrade linux-raspi-5.4Upgrade linux-gkeopUpgrade linux-azureUpgrade linux-gcp-4.15Upgrade linux-ibmUpgrade linux-azure-4.15 | Nov 19, 2024 | May 21, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub