In the Linux kernel, the following vulnerability has been resolved:
ip6_tunnel: make sure to pull inner header in __ip6_tnl_rcv()
syzbot found __ip6_tnl_rcv() could access unitiliazed data [1].
Call pskb_inet_may_pull() to fix this, and initialize ipv6h variable after this call as it can change skb->head.
[1] BUG: KMSAN: uninit-value in __INET_ECN_decapsulate include/net/inet_ecn.h:253 [inline] BUG: KMSAN: uninit-value in INET_ECN_decapsulate include/net/inet_ecn.h:275 [inline] BUG: KMSAN: uninit-value in IP6_ECN_decapsulate+0x7df/0x1e50 include/net/inet_ecn.h:321 __INET_ECN_decapsulate include/net/inet_ecn.h:253 [inline] INET_ECN_decapsulate include/net/inet_ecn.h:275 [inline] IP6_ECN_decapsulate+0x7df/0x1e50 include/net/inet_ecn.h:321 ip6ip6_dscp_ecn_decapsulate+0x178/0x1b0 net/ipv6/ip6_tunnel.c:727 __ip6_tnl_rcv+0xd4e/0x1590 net/ipv6/ip6_tunnel.c:845 ip6_tnl_rcv+0xce/0x100 net/ipv6/ip6_tunnel.c:888 gre_rcv+0x143f/0x1870 ip6_protocol_deliver_rcu+0xda6/0x2a60 net/ipv6/ip6_input.c:438 ip6_input_finish net/ipv6/ip6_input.c:483 [inline] NF_HOOK include/linux/netfilter.h:314 [inline] ip6_input+0x15d/0x430 net/ipv6/ip6_input.c:492 ip6_mc_input+0xa7e/0xc80 net/ipv6/ip6_input.c:586 dst_input include/net/dst.h:461 [inline] ip6_rcv_finish+0x5db/0x870 net/ipv6/ip6_input.c:79 NF_HOOK include/linux/netfilter.h:314 [inline] ipv6_rcv+0xda/0x390 net/ipv6/ip6_input.c:310 __netif_receive_skb_one_core net/core/dev.c:5532 [inline] __netif_receive_skb+0x1a6/0x5a0 net/core/dev.c:5646 netif_receive_skb_internal net/core/dev.c:5732 [inline] netif_receive_skb+0x58/0x660 net/core/dev.c:5791 tun_rx_batched+0x3ee/0x980 drivers/net/tun.c:1555 tun_get_user+0x53af/0x66d0 drivers/net/tun.c:2002 tun_chr_write_iter+0x3af/0x5d0 drivers/net/tun.c:2048 call_write_iter include/linux/fs.h:2084 [inline] new_sync_write fs/read_write.c:497 [inline] vfs_write+0x786/0x1200 fs/read_write.c:590 ksys_write+0x20f/0x4c0 fs/read_write.c:643 __do_sys_write fs/read_write.c:655 [inline] __se_sys_write fs/read_write.c:652 [inline] __x64_sys_write+0x93/0xd0 fs/read_write.c:652 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0x6d/0x140 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b
Uninit was created at: slab_post_alloc_hook+0x129/0xa70 mm/slab.h:768 slab_alloc_node mm/slub.c:3478 [inline] kmem_cache_alloc_node+0x5e9/0xb10 mm/slub.c:3523 kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:560 __alloc_skb+0x318/0x740 net/core/skbuff.c:651 alloc_skb include/linux/skbuff.h:1286 [inline] alloc_skb_with_frags+0xc8/0xbd0 net/core/skbuff.c:6334 sock_alloc_send_pskb+0xa80/0xbf0 net/core/sock.c:2787 tun_alloc_skb drivers/net/tun.c:1531 [inline] tun_get_user+0x1e8a/0x66d0 drivers/net/tun.c:1846 tun_chr_write_iter+0x3af/0x5d0 drivers/net/tun.c:2048 call_write_iter include/linux/fs.h:2084 [inline] new_sync_write fs/read_write.c:497 [inline] vfs_write+0x786/0x1200 fs/read_write.c:590 ksys_write+0x20f/0x4c0 fs/read_write.c:643 __do_sys_write fs/read_write.c:655 [inline] __se_sys_write fs/read_write.c:652 [inline] __x64_sys_write+0x93/0xd0 fs/read_write.c:652 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0x6d/0x140 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b
CPU: 0 PID: 5034 Comm: syz-executor331 Not tainted 6.7.0-syzkaller-00562-g9f8413c4a66f #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023
CVSS Details
- CVSS 3.1 Base Score: 8.6
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade bpftoolUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-develUpgrade kernel-tools-debuginfoUpgrade kernel-livepatch-5.15.149-99.161Upgrade python-perfUpgrade kernel-debuginfoUpgrade bpftool-debuginfoUpgrade python-perf-debuginfoUpgrade kernel-headersUpgrade kernel-toolsUpgrade kernel-tools-develUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-livepatch-5.10.210-201.852Upgrade kernelUpgrade perfUpgrade perf-debuginfo | Jul 9, 2024 | Mar 18, 2024 |
| Amazon_linux_2023 | — | Upgrade kernel-headersUpgrade kernelUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-modules-extra-commonUpgrade bpftool-debuginfoUpgrade kernel-libbpf-staticUpgrade kernel-debuginfoUpgrade perf-debuginfoUpgrade kernel-libbpf-develUpgrade kernel-toolsUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-tools-develUpgrade kernel-libbpfUpgrade python3-perf-debuginfoUpgrade kernel-livepatch-6.1.77-99.164Upgrade perfUpgrade bpftoolUpgrade kernel-modules-extraUpgrade python3-perfUpgrade kernel-tools-debuginfoUpgrade kernel-devel | Feb 17, 2025 | Mar 18, 2024 |
| Debian | — | Upgrade linux | May 8, 2024 | Mar 18, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade python3-perfUpgrade kernel-toolsUpgrade kernel-tools-libsUpgrade kernel-abi-stablelistsUpgrade kernel | Jul 16, 2024 | Mar 18, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade kernel-abi-stablelistsUpgrade kernel-toolsUpgrade kernel-tools-libsUpgrade kernelUpgrade bpftoolUpgrade python3-perf | Jun 26, 2024 | Mar 18, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade bpftoolUpgrade kernel-toolsUpgrade kernel-abi-stablelistsUpgrade kernelUpgrade kernel-tools-libsUpgrade python3-perf | Oct 8, 2024 | Mar 18, 2024 |
| Huawei Euleros 2_0_sp8 | — | Upgrade kernel-toolsUpgrade perfUpgrade kernel-develUpgrade python-perfUpgrade python3-perfUpgrade bpftoolUpgrade kernel-headersUpgrade kernel-tools-libsUpgrade kernel | Jul 23, 2024 | Mar 18, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade kernel-tools-libsUpgrade python3-perfUpgrade kernel-toolsUpgrade kernel | Jul 17, 2024 | Mar 18, 2024 |
| Redhat_linux | — | Upgrade kernel-rtNo solution existsUpgrade kernel | Dec 5, 2024 | Mar 18, 2024 |
| Suse | — | Upgrade kernel-debugUpgrade gfs2-kmp-64kbUpgrade kernel-defaultUpgrade kernel-default-livepatch-develUpgrade kernel-rt-develUpgrade ocfs2-kmp-defaultUpgrade dtb-caviumUpgrade kernel-default-vdsoUpgrade dtb-qcomUpgrade dtb-allwinnerUpgrade kselftests-kmp-64kbUpgrade kernel-default-optionalUpgrade kernel-default-baseUpgrade kernel-64kb-livepatch-develUpgrade kernel-develUpgrade kernel-symsUpgrade dtb-armUpgrade kernel-zfcpdumpUpgrade dtb-renesasUpgrade dtb-apmUpgrade kernel-kvmsmall-develUpgrade kernel-debug-develUpgrade kernel-rt-livepatchUpgrade ocfs2-kmp-azureUpgrade dtb-exynosUpgrade dtb-amdUpgrade cluster-md-kmp-azureUpgrade dtb-mediatekUpgrade kernel-64kb-optionalUpgrade dtb-rockchipUpgrade kernel-devel-rtUpgrade gfs2-kmp-azureUpgrade kernel-64kb-develUpgrade gfs2-kmp-rtUpgrade dtb-alteraUpgrade reiserfs-kmp-azureUpgrade dlm-kmp-64kbUpgrade ocfs2-kmp-rtUpgrade kernel-docsUpgrade kselftests-kmp-defaultUpgrade dtb-xilinxUpgrade kernel-rt_debug-livepatch-develUpgrade reiserfs-kmp-defaultUpgrade kernel-default-extraUpgrade kernel-sourceUpgrade cluster-md-kmp-rtUpgrade dtb-hisiliconUpgrade kernel-obs-qaUpgrade dlm-kmp-azureUpgrade dtb-marvellUpgrade kernel-debug-vdsoUpgrade kernel-source-azureUpgrade kernel-rt_debug-vdsoUpgrade reiserfs-kmp-rtUpgrade dtb-freescaleUpgrade dtb-amazonUpgrade reiserfs-kmp-64kbUpgrade kernel-syms-rtUpgrade kernel-obs-buildUpgrade gfs2-kmp-defaultUpgrade kernel-default-manUpgrade kernel-default-develUpgrade kernel-azure-livepatch-develUpgrade kernel-azure-vdsoUpgrade dtb-lgUpgrade kernel-rt-extraUpgrade dlm-kmp-defaultUpgrade kernel-rt-vdsoUpgrade kernel-kvmsmall-vdsoUpgrade kselftests-kmp-rtUpgrade kernel-azureUpgrade kselftests-kmp-azureUpgrade dtb-amlogicUpgrade cluster-md-kmp-64kbUpgrade kernel-debug-livepatch-develUpgrade kernel-azure-extraUpgrade dtb-nvidiaUpgrade kernel-azure-baseUpgrade dtb-broadcomUpgrade kernel-rt-optionalUpgrade kernel-default-livepatchUpgrade cluster-md-kmp-defaultUpgrade kernel-devel-azureUpgrade kernel-source-rtUpgrade dtb-sprdUpgrade kernel-rt-livepatch-develUpgrade kernel-64kb-extraUpgrade kernel-azure-develUpgrade kernel-source-vanillaUpgrade kernel-docs-htmlUpgrade dlm-kmp-rtUpgrade dtb-socionextUpgrade kernel-default-base-rebuildUpgrade ocfs2-kmp-64kbUpgrade kernel-rtUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-azure-optionalUpgrade kernel-64kbUpgrade dtb-appleUpgrade kernel-rt_debug-develUpgrade kernel-syms-azureUpgrade kernel-rt_debugUpgrade kernel-kvmsmallUpgrade kernel-macros | Jul 10, 2024 | Mar 18, 2024 |
| Ubuntu | — | Upgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-6.5.0-1018-raspiUpgrade linux-image-5.4.0-1102-gkeopUpgrade linux-image-generic-hwe-22.04Upgrade linux-image-5.15.0-106-generic-64kUpgrade linux-image-5.15.0-1054-raspiUpgrade linux-image-oem-20.04Upgrade linux-image-oracle-lts-22.04Upgrade linux-image-5.15.0-1058-kvmUpgrade linux-image-oem-22.04dUpgrade linux-image-virtual-hwe-18.04Upgrade linux-image-azure-cvmUpgrade linux-image-4.15.0-1182-azureUpgrade linux-image-awsUpgrade linux-image-oem-osp1Upgrade linux-image-gkeUpgrade linux-image-virtual-hwe-22.04Upgrade linux-image-4.15.0-1157-kvmUpgrade linux-image-kvmUpgrade linux-image-virtualUpgrade linux-image-5.4.0-1094-bluefieldUpgrade linux-image-raspi-hwe-18.04Upgrade linux-image-5.15.0-106-lowlatency-64kUpgrade linux-image-6.5.0-1022-gcpUpgrade linux-image-5.15.0-1057-intel-iotgUpgrade linux-image-5.15.0-1063-azure-fdeUpgrade linux-image-5.4.0-1119-raspiUpgrade linux-image-5.4.0-1139-azureUpgrade linux-image-5.15.0-1058-gkeUpgrade linux-image-raspi-nolpaeUpgrade linux-image-5.15.0-1054-ibmUpgrade linux-image-gkeop-5.15Upgrade linux-image-6.5.0-1022-azureUpgrade linux-image-nvidia-64k-6.5Upgrade linux-image-5.15.0-1059-oracleUpgrade linux-image-bluefieldUpgrade linux-image-oracle-lts-18.04Upgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-5.15.0-1063-azureUpgrade linux-image-6.5.0-41-generic-64kUpgrade linux-image-5.4.0-1082-ibmUpgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-oem-22.04bUpgrade linux-image-5.4.0-200-generic-lpaeUpgrade linux-image-lowlatency-hwe-18.04Upgrade linux-image-6.5.0-1021-nvidiaUpgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-5.15.0-1058-intel-iotgUpgrade linux-image-generic-hwe-20.04Upgrade linux-image-5.4.0-200-lowlatencyUpgrade linux-image-lowlatency-hwe-16.04Upgrade linux-image-6.5.0-1024-oemUpgrade linux-image-5.15.0-1044-gkeopUpgrade linux-image-generic-hwe-16.04Upgrade linux-image-oem-20.04dUpgrade linux-image-5.15.0-106-genericUpgrade linux-image-laptop-23.10Upgrade linux-image-aws-lts-18.04Upgrade linux-image-5.15.0-1054-nvidiaUpgrade linux-image-5.4.0-1134-oracleUpgrade linux-image-oracle-64kUpgrade linux-image-generic-hwe-18.04Upgrade linux-image-virtual-hwe-20.04Upgrade linux-image-oemUpgrade linux-image-oracleUpgrade linux-image-xilinx-zynqmpUpgrade linux-image-azure-fdeUpgrade linux-image-azureUpgrade linux-image-oem-20.04cUpgrade linux-image-6.5.0-41-lowlatencyUpgrade linux-image-gcpUpgrade linux-image-oracle-lts-20.04Upgrade linux-image-gke-5.15Upgrade linux-image-raspi2Upgrade linux-image-gcp-lts-18.04Upgrade linux-image-nvidia-lowlatencyUpgrade linux-image-5.4.0-1139-gcpUpgrade linux-image-6.5.0-1022-azure-fdeUpgrade linux-image-5.4.0-1135-awsUpgrade linux-image-azure-lts-20.04Upgrade linux-image-oem-22.04aUpgrade linux-image-ibmUpgrade linux-image-4.15.0-230-genericUpgrade linux-image-intel-iotgUpgrade linux-image-oem-22.04cUpgrade linux-image-6.5.0-1021-awsUpgrade linux-image-5.4.0-200-genericUpgrade linux-image-lowlatency-64kUpgrade linux-image-5.15.0-1054-nvidia-lowlatencyUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-nvidia-6.5Upgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-gcp-lts-20.04Upgrade linux-image-azure-fde-lts-22.04Upgrade linux-image-aws-lts-22.04Upgrade linux-image-6.5.0-1015-starfiveUpgrade linux-image-5.15.0-106-lowlatencyUpgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-6.5.0-1021-nvidia-64kUpgrade linux-image-gkeopUpgrade linux-image-azure-lts-18.04Upgrade linux-image-azure-lts-22.04Upgrade linux-image-ibm-lts-20.04Upgrade linux-image-5.15.0-1059-gcpUpgrade linux-image-6.5.0-1024-oracle-64kUpgrade linux-image-5.15.0-106-generic-lpaeUpgrade linux-image-5.4.0-1054-xilinx-zynqmpUpgrade linux-image-generic-lpaeUpgrade linux-image-oem-22.04Upgrade linux-image-5.4.0-1123-kvmUpgrade linux-image-genericUpgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-generic-64kUpgrade linux-image-lowlatencyUpgrade linux-image-4.15.0-1174-awsUpgrade linux-image-5.4.0-1044-iotUpgrade linux-image-6.5.0-1017-laptopUpgrade linux-image-5.4.0-1140-azureUpgrade linux-image-4.15.0-1136-oracleUpgrade linux-image-6.5.0-41-genericUpgrade linux-image-virtual-hwe-16.04Upgrade linux-image-gcp-lts-22.04Upgrade linux-image-4.15.0-230-lowlatencyUpgrade linux-image-gkeop-5.4Upgrade linux-image-4.15.0-1167-gcpUpgrade linux-image-raspiUpgrade linux-image-5.15.0-1061-awsUpgrade linux-image-aws-hweUpgrade linux-image-oem-20.04bUpgrade linux-image-6.5.0-41-lowlatency-64kUpgrade linux-image-6.5.0-1024-oracleUpgrade linux-image-nvidiaUpgrade linux-image-starfiveUpgrade linux-image-aws-lts-20.04Upgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-snapdragon-hwe-18.04Upgrade linux-image-intel | May 17, 2024 | Mar 18, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Mar 18, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub