In the Linux kernel, the following vulnerability has been resolved:
ipvlan: add ipvlan_route_v6_outbound() helper
Inspired by syzbot reports using a stack of multiple ipvlan devices.
Reduce stack size needed in ipvlan_process_v6_outbound() by moving the flowi6 struct used for the route lookup in an non inlined helper. ipvlan_route_v6_outbound() needs 120 bytes on the stack, immediately reclaimed.
Also make sure ipvlan_process_v4_outbound() is not inlined.
We might also have to lower MAX_NEST_DEV, because only syzbot uses setups with more than four stacked devices.
BUG: TASK stack guard page was hit at ffffc9000e803ff8 (stack is ffffc9000e804000..ffffc9000e808000) stack guard page: 0000 [#1] SMP KASAN CPU: 0 PID: 13442 Comm: syz-executor.4 Not tainted 6.1.52-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/09/2023 RIP: 0010:kasan_check_range+0x4/0x2a0 mm/kasan/generic.c:188 Code: 48 01 c6 48 89 c7 e8 db 4e c1 03 31 c0 5d c3 cc 0f 0b eb 02 0f 0b b8 ea ff ff ff 5d c3 cc 00 00 cc cc 00 00 cc cc 55 48 89 e5 <41> 57 41 56 41 55 41 54 53 b0 01 48 85 f6 0f 84 a4 01 00 00 48 89 RSP: 0018:ffffc9000e804000 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff817e5bf2 RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffffff887c6568 RBP: ffffc9000e804000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: dffffc0000000001 R12: 1ffff92001d0080c R13: dffffc0000000000 R14: ffffffff87e6b100 R15: 0000000000000000 FS: 00007fd0c55826c0(0000) GS:ffff8881f6800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffc9000e803ff8 CR3: 0000000170ef7000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <#DF> </#DF> <TASK> [<ffffffff81f281d1>] __kasan_check_read+0x11/0x20 mm/kasan/shadow.c:31 [<ffffffff817e5bf2>] instrument_atomic_read include/linux/instrumented.h:72 [inline] [<ffffffff817e5bf2>] _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline] [<ffffffff817e5bf2>] cpumask_test_cpu include/linux/cpumask.h:506 [inline] [<ffffffff817e5bf2>] cpu_online include/linux/cpumask.h:1092 [inline] [<ffffffff817e5bf2>] trace_lock_acquire include/trace/events/lock.h:24 [inline] [<ffffffff817e5bf2>] lock_acquire+0xe2/0x590 kernel/locking/lockdep.c:5632 [<ffffffff8563221e>] rcu_lock_acquire+0x2e/0x40 include/linux/rcupdate.h:306 [<ffffffff8561464d>] rcu_read_lock include/linux/rcupdate.h:747 [inline] [<ffffffff8561464d>] ip6_pol_route+0x15d/0x1440 net/ipv6/route.c:2221 [<ffffffff85618120>] ip6_pol_route_output+0x50/0x80 net/ipv6/route.c:2606 [<ffffffff856f65b5>] pol_lookup_func include/net/ip6_fib.h:584 [inline] [<ffffffff856f65b5>] fib6_rule_lookup+0x265/0x620 net/ipv6/fib6_rules.c:116 [<ffffffff85618009>] ip6_route_output_flags_noref+0x2d9/0x3a0 net/ipv6/route.c:2638 [<ffffffff8561821a>] ip6_route_output_flags+0xca/0x340 net/ipv6/route.c:2651 [<ffffffff838bd5a3>] ip6_route_output include/net/ip6_route.h:100 [inline] [<ffffffff838bd5a3>] ipvlan_process_v6_outbound drivers/net/ipvlan/ipvlan_core.c:473 [inline] [<ffffffff838bd5a3>] ipvlan_process_outbound drivers/net/ipvlan/ipvlan_core.c:529 [inline] [<ffffffff838bd5a3>] ipvlan_xmit_mode_l3 drivers/net/ipvlan/ipvlan_core.c:602 [inline] [<ffffffff838bd5a3>] ipvlan_queue_xmit+0xc33/0x1be0 drivers/net/ipvlan/ipvlan_core.c:677 [<ffffffff838c2909>] ipvlan_start_xmit+0x49/0x100 drivers/net/ipvlan/ipvlan_main.c:229 [<ffffffff84d03900>] netdev_start_xmit include/linux/netdevice.h:4966 [inline] [<ffffffff84d03900>] xmit_one net/core/dev.c:3644 [inline] [<ffffffff84d03900>] dev_hard_start_xmit+0x320/0x980 net/core/dev.c:3660 [<ffffffff84d080e2>] __dev_queue_xmit+0x16b2/0x3370 net/core/dev.c:4324 [<ffffffff855ce4cd>] dev_queue_xmit include/linux/netdevice.h:3067 [inline] [<ffffffff855ce4cd>] neigh_hh_output include/net/neighbour.h:529 [inline] [<f ---truncated---
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-debug-modulesUpgrade kernel-rtUpgrade kernel-abi-stablelistsUpgrade kernel-zfcpdump-modulesUpgrade bpftoolUpgrade kernel-debug-modules-extraUpgrade kernel-docUpgrade kernel-rt-debug-modules-extraUpgrade perfUpgrade kernel-rt-kvmUpgrade kernel-zfcpdumpUpgrade kernel-zfcpdump-coreUpgrade kernel-rt-debug-modulesUpgrade kernel-rt-modulesUpgrade kernel-toolsUpgrade kernel-rt-develUpgrade kernel-tools-libsUpgrade kernel-tools-libs-develUpgrade python3-perfUpgrade kernel-rt-debug-coreUpgrade kernel-headersUpgrade kernel-debug-develUpgrade kernel-zfcpdump-develUpgrade kernel-debugUpgrade kernel-rt-debug-kvmUpgrade kernel-modules-extraUpgrade kernel-rt-debug-develUpgrade kernel-cross-headersUpgrade kernelUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-coreUpgrade kernel-rt-coreUpgrade kernel-debug-coreUpgrade kernel-rt-debugUpgrade kernel-modulesUpgrade kernel-rt-modules-extraUpgrade kernel-devel | Aug 12, 2024 | May 21, 2024 |
| Amazon Linux Ami 2 | — | Upgrade kernel-debuginfo-common-x86_64Upgrade kernel-livepatch-4.14.349-266.564Upgrade python-perf-debuginfoUpgrade kernel-headersUpgrade kernelUpgrade kernel-toolsUpgrade bpftool-debuginfoUpgrade kernel-livepatch-5.10.205-195.804Upgrade python-perfUpgrade bpftoolUpgrade kernel-debuginfoUpgrade kernel-develUpgrade perfUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-tools-debuginfoUpgrade perf-debuginfoUpgrade kernel-tools-develUpgrade kernel-livepatch-5.15.145-95.156 | Jun 26, 2024 | May 21, 2024 |
| Amazon_linux_2023 | — | Upgrade kernel-debuginfo-common-x86_64Upgrade bpftool-debuginfoUpgrade kernel-toolsUpgrade kernel-develUpgrade kernel-modules-extraUpgrade kernel-debuginfoUpgrade kernel-headersUpgrade kernel-tools-develUpgrade kernel-libbpfUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-libbpf-develUpgrade perfUpgrade kernel-libbpf-staticUpgrade kernel-tools-debuginfoUpgrade python3-perfUpgrade perf-debuginfoUpgrade kernel-livepatch-6.1.66-91.160Upgrade bpftoolUpgrade python3-perf-debuginfoUpgrade kernel | Feb 17, 2025 | May 21, 2024 |
| Debian | — | Upgrade linux | Jul 30, 2024 | May 21, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade python3-perfUpgrade kernel-abi-stablelistsUpgrade kernel-tools-libsUpgrade kernel-toolsUpgrade kernel | Oct 8, 2024 | May 21, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade kernel-tools-libsUpgrade kernel-toolsUpgrade kernel-abi-stablelistsUpgrade kernelUpgrade python3-perfUpgrade bpftool | Oct 8, 2024 | May 21, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade python3-perfUpgrade kernelUpgrade kernel-toolsUpgrade kernel-tools-libs | Oct 8, 2024 | May 21, 2024 |
| Oracle_linux | — | Upgrade kernel-uekUpgrade kernel | Aug 16, 2024 | May 21, 2024 |
| Redhat_linux | — | Upgrade kernelNo solution existsUpgrade kernel-rt | Aug 12, 2024 | May 21, 2024 |
| Rocky_linux | — | Upgrade kernel-rt-debug-develUpgrade kernel-rt-debug-modules-extraUpgrade perf-debuginfoUpgrade kernel-debuginfoUpgrade kernelUpgrade kernel-debugUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-coreUpgrade kernel-rt-debug-kvmUpgrade kernel-debug-develUpgrade kernel-modules-extraUpgrade kernel-debug-modules-extraUpgrade kernel-headersUpgrade kernel-rt-debug-modulesUpgrade kernel-rt-coreUpgrade kernel-modulesUpgrade kernel-cross-headersUpgrade kernel-debug-coreUpgrade kernel-tools-debuginfoUpgrade kernel-rt-kvmUpgrade kernel-rt-debug-coreUpgrade kernel-debug-debuginfoUpgrade kernel-rt-debugUpgrade kernel-rt-modulesUpgrade kernel-rt-debuginfoUpgrade kernel-rt-debug-debuginfoUpgrade python3-perfUpgrade bpftoolUpgrade bpftool-debuginfoUpgrade kernel-tools-libs-develUpgrade kernel-rt-develUpgrade kernel-toolsUpgrade python3-perf-debuginfoUpgrade kernel-debug-modulesUpgrade kernel-rtUpgrade kernel-develUpgrade kernel-rt-debuginfo-common-x86_64Upgrade perfUpgrade kernel-tools-libsUpgrade kernel-rt-modules-extra | Aug 22, 2024 | May 21, 2024 |
| Suse | — | Upgrade kernel-macrosUpgrade dtb-amlogicUpgrade kernel-kvmsmall-vdsoUpgrade kselftests-kmp-64kbUpgrade kernel-azure-livepatch-develUpgrade kernel-azure-optionalUpgrade kernel-debug-livepatch-develUpgrade cluster-md-kmp-defaultUpgrade gfs2-kmp-rtUpgrade kernel-64kb-develUpgrade kernel-zfcpdumpUpgrade dtb-marvellUpgrade kernel-rt_debug-develUpgrade kernel-azure-baseUpgrade kernel-default-extraUpgrade kselftests-kmp-azureUpgrade kernel-azure-develUpgrade dtb-amazonUpgrade gfs2-kmp-64kbUpgrade kernel-64kb-optionalUpgrade dtb-hisiliconUpgrade kernel-default-livepatchUpgrade dtb-alteraUpgrade kernel-64kbUpgrade gfs2-kmp-azureUpgrade dtb-lgUpgrade kernel-docs-htmlUpgrade kernel-source-azureUpgrade kernel-default-develUpgrade kernel-symsUpgrade dtb-apmUpgrade dtb-broadcomUpgrade dtb-freescaleUpgrade kernel-azure-extraUpgrade kernel-syms-azureUpgrade kernel-64kb-livepatch-develUpgrade kernel-kvmsmallUpgrade ocfs2-kmp-rtUpgrade ocfs2-kmp-64kbUpgrade kernel-sourceUpgrade kernel-rt-livepatchUpgrade dtb-qcomUpgrade kernel-debugUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-rtUpgrade dtb-caviumUpgrade dlm-kmp-64kbUpgrade reiserfs-kmp-64kbUpgrade dtb-appleUpgrade kernel-default-vdsoUpgrade kernel-devel-azureUpgrade kernel-source-rtUpgrade dtb-exynosUpgrade cluster-md-kmp-rtUpgrade kernel-kvmsmall-develUpgrade cluster-md-kmp-azureUpgrade kernel-default-optionalUpgrade kernel-obs-qaUpgrade dtb-xilinxUpgrade dlm-kmp-defaultUpgrade dtb-renesasUpgrade reiserfs-kmp-defaultUpgrade kernel-azureUpgrade kernel-rt_debugUpgrade ocfs2-kmp-defaultUpgrade kernel-devel-rtUpgrade kernel-default-base-rebuildUpgrade dlm-kmp-rtUpgrade dlm-kmp-azureUpgrade kernel-debug-vdsoUpgrade dtb-rockchipUpgrade cluster-md-kmp-64kbUpgrade kernel-default-baseUpgrade reiserfs-kmp-rtUpgrade kernel-rt-extraUpgrade kernel-rt-develUpgrade kernel-rt-livepatch-develUpgrade kernel-defaultUpgrade kselftests-kmp-defaultUpgrade kernel-obs-buildUpgrade kernel-debug-develUpgrade kernel-source-vanillaUpgrade kselftests-kmp-rtUpgrade kernel-rt-vdsoUpgrade kernel-default-manUpgrade kernel-default-livepatch-develUpgrade kernel-azure-vdsoUpgrade dtb-socionextUpgrade dtb-sprdUpgrade ocfs2-kmp-azureUpgrade kernel-develUpgrade dtb-mediatekUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-64kb-extraUpgrade kernel-docsUpgrade dtb-amdUpgrade kernel-syms-rtUpgrade dtb-allwinnerUpgrade gfs2-kmp-defaultUpgrade kernel-rt-optionalUpgrade dtb-nvidiaUpgrade reiserfs-kmp-azureUpgrade kernel-rt_debug-vdsoUpgrade dtb-arm | Jun 12, 2024 | May 21, 2024 |
| Ubuntu | — | Upgrade linux-azure-fipsUpgrade linux-awsUpgrade linux-azureUpgrade linux-hwe-5.15Upgrade linux-hwe-5.4Upgrade linux-gcp-fipsUpgrade linux-aws-5.4Upgrade linux-iotUpgrade linux-azure-5.4Upgrade linux-aws-fipsUpgrade linux-raspiUpgrade linux-nvidia-6.5Upgrade linuxUpgrade linux-lowlatencyUpgrade linux-azure-fdeUpgrade linux-ibmUpgrade linux-ibm-5.4Upgrade linux-intel-iotg-5.15Upgrade linux-gkeop-5.15Upgrade linux-nvidia-tegra-5.15Upgrade linux-raspi-5.4Upgrade linux-gcp-5.4Upgrade linux-gkeUpgrade linux-kvmUpgrade linux-oracle-5.15Upgrade linux-gcp-5.15Upgrade linux-intel-iot-realtimeUpgrade linux-oracleUpgrade linux-realtimeUpgrade linux-aws-5.15Upgrade linux-nvidia-tegra-igxUpgrade linux-oracle-5.4Upgrade linux-fipsUpgrade linux-ibm-5.15Upgrade linux-riscv-5.15Upgrade linux-nvidia-tegraUpgrade linux-azure-5.15Upgrade linux-bluefieldUpgrade linux-gkeopUpgrade linux-gcpUpgrade linux-xilinx-zynqmpUpgrade linux-intel-iotgUpgrade linux-nvidiaUpgrade linux-lowlatency-hwe-5.15 | Nov 19, 2024 | May 21, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | May 21, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub