In the Linux kernel, the following vulnerability has been resolved:
ipv6: sr: fix out-of-bounds read when setting HMAC data.
The SRv6 layer allows defining HMAC data that can later be used to sign IPv6 Segment Routing Headers. This configuration is realised via netlink through four attributes: SEG6_ATTR_HMACKEYID, SEG6_ATTR_SECRET, SEG6_ATTR_SECRETLEN and SEG6_ATTR_ALGID. Because the SECRETLEN attribute is decoupled from the actual length of the SECRET attribute, it is possible to provide invalid combinations (e.g., secret = "", secretlen = 64). This case is not checked in the code and with an appropriately crafted netlink message, an out-of-bounds read of up to 64 bytes (max secret length) can occur past the skb end pointer and into skb_shared_info:
Breakpoint 1, seg6_genl_sethmac (skb=<optimized out>, info=<optimized out>) at net/ipv6/seg6.c:208 208 memcpy(hinfo->secret, secret, slen); (gdb) bt #0 seg6_genl_sethmac (skb=<optimized out>, info=<optimized out>) at net/ipv6/seg6.c:208 #1 0xffffffff81e012e9 in genl_family_rcv_msg_doit (skb=skb@entry=0xffff88800b1f9f00, nlh=nlh@entry=0xffff88800b1b7600, extack=extack@entry=0xffffc90000ba7af0, ops=ops@entry=0xffffc90000ba7a80, hdrlen=4, net=0xffffffff84237580 <init_net>, family=<optimized out>, family=<optimized out>) at net/netlink/genetlink.c:731 #2 0xffffffff81e01435 in genl_family_rcv_msg (extack=0xffffc90000ba7af0, nlh=0xffff88800b1b7600, skb=0xffff88800b1f9f00, family=0xffffffff82fef6c0 <seg6_genl_family>) at net/netlink/genetlink.c:775 #3 genl_rcv_msg (skb=0xffff88800b1f9f00, nlh=0xffff88800b1b7600, extack=0xffffc90000ba7af0) at net/netlink/genetlink.c:792 #4 0xffffffff81dfffc3 in netlink_rcv_skb (skb=skb@entry=0xffff88800b1f9f00, cb=cb@entry=0xffffffff81e01350 <genl_rcv_msg>) at net/netlink/af_netlink.c:2501 #5 0xffffffff81e00919 in genl_rcv (skb=0xffff88800b1f9f00) at net/netlink/genetlink.c:803 #6 0xffffffff81dff6ae in netlink_unicast_kernel (ssk=0xffff888010eec800, skb=0xffff88800b1f9f00, sk=0xffff888004aed000) at net/netlink/af_netlink.c:1319 #7 netlink_unicast (ssk=ssk@entry=0xffff888010eec800, skb=skb@entry=0xffff88800b1f9f00, portid=portid@entry=0, nonblock=<optimized out>) at net/netlink/af_netlink.c:1345 #8 0xffffffff81dff9a4 in netlink_sendmsg (sock=<optimized out>, msg=0xffffc90000ba7e48, len=<optimized out>) at net/netlink/af_netlink.c:1921 ... (gdb) p/x ((struct sk_buff *)0xffff88800b1f9f00)->head + ((struct sk_buff *)0xffff88800b1f9f00)->end $1 = 0xffff88800b1b76c0 (gdb) p/x secret $2 = 0xffff88800b1b76c0 (gdb) p slen $3 = 64 '@'
The OOB data can then be read back from userspace by dumping HMAC state. This commit fixes this by ensuring SECRETLEN cannot exceed the actual length of SECRET.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade kernel-headersUpgrade perf-debuginfoUpgrade kernel-tools-develUpgrade python-perf-debuginfoUpgrade kernel-livepatch-4.14.294-220.533Upgrade kernel-livepatch-5.10.144-127.601Upgrade perfUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-livepatch-5.15.69-37.134Upgrade kernel-tools-debuginfoUpgrade kernel-debuginfoUpgrade kernel-develUpgrade python-perfUpgrade bpftoolUpgrade kernelUpgrade bpftool-debuginfoUpgrade kernel-toolsUpgrade kernel-debuginfo-common-x86_64 | Jun 11, 2024 | May 3, 2024 |
| Amazon_linux | — | Upgrade kernel | Jun 7, 2024 | Oct 11, 2022 |
| Debian | — | Upgrade linux | Jul 30, 2024 | May 3, 2024 |
| Dell Powerstore Dsa2024408 | — | Upgrade Dell PowerStoreOS to the latest version | Jan 13, 2026 | Sep 26, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | May 3, 2024 |
| Suse | — | Upgrade gfs2-kmp-rtUpgrade kernel-docsUpgrade kernel-default-extraUpgrade kernel-default-base-rebuildUpgrade gfs2-kmp-64kbUpgrade dtb-nvidiaUpgrade kernel-obs-qaUpgrade kernel-symsUpgrade kernel-default-baseUpgrade reiserfs-kmp-azureUpgrade kernel-zfcpdumpUpgrade kernel-azure-livepatch-develUpgrade kselftests-kmp-rtUpgrade dtb-amlogicUpgrade cluster-md-kmp-defaultUpgrade kernel-rtUpgrade kernel-defaultUpgrade dtb-xilinxUpgrade kernel-preemptUpgrade dtb-rockchipUpgrade reiserfs-kmp-defaultUpgrade kernel-debugUpgrade kernel-syms-rtUpgrade kernel-devel-rtUpgrade dlm-kmp-azureUpgrade kernel-rt-develUpgrade kernel-macrosUpgrade kernel-64kb-develUpgrade dlm-kmp-rtUpgrade kernel-debug-livepatch-develUpgrade kernel-develUpgrade dlm-kmp-defaultUpgrade kselftests-kmp-defaultUpgrade ocfs2-kmp-azureUpgrade kernel-rt-livepatchUpgrade cluster-md-kmp-rtUpgrade dtb-hisiliconUpgrade kernel-default-optionalUpgrade kernel-64kb-livepatch-develUpgrade kernel-rt_debug-vdsoUpgrade dtb-apmUpgrade ocfs2-kmp-rtUpgrade dtb-qcomUpgrade dtb-mediatekUpgrade kernel-kvmsmallUpgrade dtb-armUpgrade dtb-appleUpgrade kernel-azureUpgrade kernel-sourceUpgrade kernel-kvmsmall-develUpgrade kernel-debug-develUpgrade kernel-default-livepatchUpgrade kernel-rt_debugUpgrade cluster-md-kmp-64kbUpgrade dtb-allwinnerUpgrade kernel-rt-optionalUpgrade kernel-docs-htmlUpgrade kernel-default-livepatch-develUpgrade kernel-64kb-optionalUpgrade dtb-amazonUpgrade kernel-default-vdsoUpgrade kselftests-kmp-64kbUpgrade dtb-lgUpgrade kernel-azure-optionalUpgrade dtb-exynosUpgrade kselftests-kmp-azureUpgrade kernel-azure-develUpgrade dtb-marvellUpgrade gfs2-kmp-defaultUpgrade dtb-caviumUpgrade kernel-64kbUpgrade ocfs2-kmp-defaultUpgrade dtb-alteraUpgrade kernel-azure-vdsoUpgrade kernel-64kb-extraUpgrade dlm-kmp-64kbUpgrade cluster-md-kmp-azureUpgrade kernel-syms-azureUpgrade reiserfs-kmp-rtUpgrade dtb-sprdUpgrade dtb-freescaleUpgrade kernel-obs-buildUpgrade kernel-azure-baseUpgrade gfs2-kmp-azureUpgrade kernel-source-vanillaUpgrade kernel-rt-vdsoUpgrade kernel-rt-extraUpgrade dtb-broadcomUpgrade kernel-preempt-develUpgrade kernel-source-azureUpgrade kernel-kvmsmall-vdsoUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-rt_debug-develUpgrade ocfs2-kmp-64kbUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-default-manUpgrade reiserfs-kmp-64kbUpgrade dtb-renesasUpgrade dtb-amdUpgrade kernel-source-rtUpgrade kernel-devel-azureUpgrade kernel-default-develUpgrade kernel-debug-vdsoUpgrade kernel-azure-extraUpgrade dtb-socionextUpgrade kernel-rt-livepatch-devel | Aug 9, 2024 | May 3, 2024 |
| Ubuntu | — | Upgrade linux-awsUpgrade linux-azure-fipsUpgrade linux-gkeUpgrade linuxUpgrade linux-aws-5.4Upgrade linux-gcp-5.4Upgrade linux-oracle-5.4Upgrade linux-ibm-5.4Upgrade linux-lowlatencyUpgrade linux-aws-5.15Upgrade linux-gcpUpgrade linux-lowlatency-hwe-5.15Upgrade linux-oracle-5.15Upgrade linux-azure-fdeUpgrade linux-oracleUpgrade linux-kvmUpgrade linux-hweUpgrade linux-intel-iotgUpgrade linux-hwe-5.15Upgrade linux-ibmUpgrade linux-aws-hweUpgrade linux-bluefieldUpgrade linux-gcp-5.15Upgrade linux-raspiUpgrade linux-azureUpgrade linux-azure-4.15Upgrade linux-intel-iotg-5.15Upgrade linux-iotUpgrade linux-azure-5.4Upgrade linux-nvidiaUpgrade linux-realtimeUpgrade linux-riscv-5.15Upgrade linux-gcp-fipsUpgrade linux-azure-5.15Upgrade linux-fipsUpgrade linux-raspi-5.4Upgrade linux-hwe-5.4Upgrade linux-gkeop-5.15Upgrade linux-gcp-4.15Upgrade linux-aws-fipsUpgrade linux-gkeop | Nov 19, 2024 | May 3, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | May 3, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub