In the Linux kernel, the following vulnerability has been resolved:
ipv6: sr: fix out-of-bounds read when setting HMAC data.
The SRv6 layer allows defining HMAC data that can later be used to sign IPv6 Segment Routing Headers. This configuration is realised via netlink through four attributes: SEG6_ATTR_HMACKEYID, SEG6_ATTR_SECRET, SEG6_ATTR_SECRETLEN and SEG6_ATTR_ALGID. Because the SECRETLEN attribute is decoupled from the actual length of the SECRET attribute, it is possible to provide invalid combinations (e.g., secret = "", secretlen = 64). This case is not checked in the code and with an appropriately crafted netlink message, an out-of-bounds read of up to 64 bytes (max secret length) can occur past the skb end pointer and into skb_shared_info:
Breakpoint 1, seg6_genl_sethmac (skb=<optimized out>, info=<optimized out>) at net/ipv6/seg6.c:208 208 memcpy(hinfo->secret, secret, slen); (gdb) bt #0 seg6_genl_sethmac (skb=<optimized out>, info=<optimized out>) at net/ipv6/seg6.c:208 #1 0xffffffff81e012e9 in genl_family_rcv_msg_doit (skb=skb@entry=0xffff88800b1f9f00, nlh=nlh@entry=0xffff88800b1b7600, extack=extack@entry=0xffffc90000ba7af0, ops=ops@entry=0xffffc90000ba7a80, hdrlen=4, net=0xffffffff84237580 <init_net>, family=<optimized out>, family=<optimized out>) at net/netlink/genetlink.c:731 #2 0xffffffff81e01435 in genl_family_rcv_msg (extack=0xffffc90000ba7af0, nlh=0xffff88800b1b7600, skb=0xffff88800b1f9f00, family=0xffffffff82fef6c0 <seg6_genl_family>) at net/netlink/genetlink.c:775 #3 genl_rcv_msg (skb=0xffff88800b1f9f00, nlh=0xffff88800b1b7600, extack=0xffffc90000ba7af0) at net/netlink/genetlink.c:792 #4 0xffffffff81dfffc3 in netlink_rcv_skb (skb=skb@entry=0xffff88800b1f9f00, cb=cb@entry=0xffffffff81e01350 <genl_rcv_msg>) at net/netlink/af_netlink.c:2501 #5 0xffffffff81e00919 in genl_rcv (skb=0xffff88800b1f9f00) at net/netlink/genetlink.c:803 #6 0xffffffff81dff6ae in netlink_unicast_kernel (ssk=0xffff888010eec800, skb=0xffff88800b1f9f00, sk=0xffff888004aed000) at net/netlink/af_netlink.c:1319 #7 netlink_unicast (ssk=ssk@entry=0xffff888010eec800, skb=skb@entry=0xffff88800b1f9f00, portid=portid@entry=0, nonblock=<optimized out>) at net/netlink/af_netlink.c:1345 #8 0xffffffff81dff9a4 in netlink_sendmsg (sock=<optimized out>, msg=0xffffc90000ba7e48, len=<optimized out>) at net/netlink/af_netlink.c:1921 ... (gdb) p/x ((struct sk_buff *)0xffff88800b1f9f00)->head + ((struct sk_buff *)0xffff88800b1f9f00)->end $1 = 0xffff88800b1b76c0 (gdb) p/x secret $2 = 0xffff88800b1b76c0 (gdb) p slen $3 = 64 '@'
The OOB data can then be read back from userspace by dumping HMAC state. This commit fixes this by ensuring SECRETLEN cannot exceed the actual length of SECRET.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade kernelUpgrade bpftoolUpgrade bpftool-debuginfoUpgrade python-perfUpgrade kernel-tools-debuginfoUpgrade kernel-toolsUpgrade kernel-livepatch-5.15.69-37.134Upgrade kernel-develUpgrade perf-debuginfoUpgrade kernel-tools-develUpgrade kernel-livepatch-4.14.294-220.533Upgrade kernel-livepatch-5.10.144-127.601Upgrade python-perf-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-headersUpgrade perfUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-debuginfo | Jun 11, 2024 | May 3, 2024 |
| Amazon_linux | — | Upgrade kernel | Jun 7, 2024 | Oct 11, 2022 |
| Debian | — | Upgrade linux | Jul 30, 2024 | May 3, 2024 |
| Dell Powerstore Dsa2024408 | — | Upgrade Dell PowerStoreOS to the latest version | Jan 13, 2026 | Sep 26, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | May 3, 2024 |
| Suse | — | Upgrade kernel-rt_debug-vdsoUpgrade kselftests-kmp-defaultUpgrade kernel-docsUpgrade reiserfs-kmp-azureUpgrade kernel-default-extraUpgrade ocfs2-kmp-azureUpgrade dtb-amlogicUpgrade dlm-kmp-defaultUpgrade kernel-symsUpgrade kernel-default-base-rebuildUpgrade dtb-xilinxUpgrade kernel-develUpgrade kernel-macrosUpgrade kernel-64kb-develUpgrade kernel-obs-qaUpgrade kernel-debug-livepatch-develUpgrade dtb-qcomUpgrade kselftests-kmp-rtUpgrade gfs2-kmp-rtUpgrade dtb-mediatekUpgrade ocfs2-kmp-rtUpgrade dtb-apmUpgrade kernel-zfcpdumpUpgrade dtb-nvidiaUpgrade kernel-defaultUpgrade dtb-hisiliconUpgrade cluster-md-kmp-rtUpgrade dtb-rockchipUpgrade gfs2-kmp-64kbUpgrade kernel-preemptUpgrade kernel-rtUpgrade kernel-64kb-livepatch-develUpgrade kernel-azure-livepatch-develUpgrade kernel-rt-livepatchUpgrade kernel-default-baseUpgrade kernel-rt-develUpgrade kernel-syms-rtUpgrade dtb-armUpgrade dlm-kmp-azureUpgrade kernel-devel-rtUpgrade reiserfs-kmp-defaultUpgrade kernel-default-optionalUpgrade kernel-debugUpgrade dlm-kmp-rtUpgrade cluster-md-kmp-defaultUpgrade kernel-kvmsmallUpgrade kernel-64kb-extraUpgrade kernel-preempt-develUpgrade kernel-default-livepatch-develUpgrade dtb-amazonUpgrade dtb-allwinnerUpgrade kernel-azure-extraUpgrade dtb-renesasUpgrade kernel-source-rtUpgrade kernel-devel-azureUpgrade kernel-default-develUpgrade dtb-amdUpgrade kernel-debug-vdsoUpgrade ocfs2-kmp-64kbUpgrade kernel-rt_debug-develUpgrade kernel-obs-buildUpgrade gfs2-kmp-defaultUpgrade dtb-broadcomUpgrade kernel-kvmsmall-vdsoUpgrade reiserfs-kmp-64kbUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-source-azureUpgrade dtb-socionextUpgrade kernel-rt-vdsoUpgrade dtb-alteraUpgrade kernel-sourceUpgrade kernel-azure-vdsoUpgrade kernel-kvmsmall-develUpgrade dlm-kmp-64kbUpgrade cluster-md-kmp-azureUpgrade kernel-azure-baseUpgrade kernel-source-vanillaUpgrade kernel-rt-extraUpgrade kernel-rt_debugUpgrade kernel-azureUpgrade kernel-debug-develUpgrade gfs2-kmp-azureUpgrade kernel-rt-livepatch-develUpgrade kernel-default-livepatchUpgrade dtb-exynosUpgrade kernel-azure-develUpgrade kernel-64kbUpgrade dtb-caviumUpgrade kselftests-kmp-azureUpgrade kernel-syms-azureUpgrade kernel-default-vdsoUpgrade reiserfs-kmp-rtUpgrade ocfs2-kmp-defaultUpgrade kselftests-kmp-64kbUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-default-manUpgrade kernel-azure-optionalUpgrade dtb-marvellUpgrade dtb-sprdUpgrade dtb-appleUpgrade dtb-lgUpgrade dtb-freescaleUpgrade kernel-rt-optionalUpgrade kernel-docs-htmlUpgrade kernel-64kb-optionalUpgrade cluster-md-kmp-64kb | Aug 9, 2024 | May 3, 2024 |
| Ubuntu | — | Upgrade linux-oracle-5.4Upgrade linux-aws-5.15Upgrade linux-aws-5.4Upgrade linux-awsUpgrade linuxUpgrade linux-gcpUpgrade linux-azure-fipsUpgrade linux-lowlatencyUpgrade linux-gcp-5.4Upgrade linux-ibm-5.4Upgrade linux-gkeUpgrade linux-hwe-5.15Upgrade linux-iotUpgrade linux-gkeop-5.15Upgrade linux-riscv-5.15Upgrade linux-nvidiaUpgrade linux-bluefieldUpgrade linux-hwe-5.4Upgrade linux-gkeopUpgrade linux-gcp-5.15Upgrade linux-fipsUpgrade linux-lowlatency-hwe-5.15Upgrade linux-azure-5.4Upgrade linux-oracle-5.15Upgrade linux-gcp-fipsUpgrade linux-raspiUpgrade linux-intel-iotgUpgrade linux-azure-5.15Upgrade linux-azure-fdeUpgrade linux-aws-hweUpgrade linux-ibmUpgrade linux-aws-fipsUpgrade linux-kvmUpgrade linux-hweUpgrade linux-oracleUpgrade linux-azure-4.15Upgrade linux-raspi-5.4Upgrade linux-azureUpgrade linux-gcp-4.15Upgrade linux-realtimeUpgrade linux-intel-iotg-5.15 | Nov 19, 2024 | May 3, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | May 3, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub