In the Linux kernel, the following vulnerability has been resolved:
net: ip_tunnel: make sure to pull inner header in ip_tunnel_rcv()
Apply the same fix than ones found in :
8d975c15c0cd ("ip6_tunnel: make sure to pull inner header in __ip6_tnl_rcv()") 1ca1ba465e55 ("geneve: make sure to pull inner header in geneve_rx()")
We have to save skb->network_header in a temporary variable in order to be able to recompute the network_header pointer after a pskb_inet_may_pull() call.
pskb_inet_may_pull() makes sure the needed headers are in skb->head.
syzbot reported: BUG: KMSAN: uninit-value in __INET_ECN_decapsulate include/net/inet_ecn.h:253 [inline] BUG: KMSAN: uninit-value in INET_ECN_decapsulate include/net/inet_ecn.h:275 [inline] BUG: KMSAN: uninit-value in IP_ECN_decapsulate include/net/inet_ecn.h:302 [inline] BUG: KMSAN: uninit-value in ip_tunnel_rcv+0xed9/0x2ed0 net/ipv4/ip_tunnel.c:409 __INET_ECN_decapsulate include/net/inet_ecn.h:253 [inline] INET_ECN_decapsulate include/net/inet_ecn.h:275 [inline] IP_ECN_decapsulate include/net/inet_ecn.h:302 [inline] ip_tunnel_rcv+0xed9/0x2ed0 net/ipv4/ip_tunnel.c:409 __ipgre_rcv+0x9bc/0xbc0 net/ipv4/ip_gre.c:389 ipgre_rcv net/ipv4/ip_gre.c:411 [inline] gre_rcv+0x423/0x19f0 net/ipv4/ip_gre.c:447 gre_rcv+0x2a4/0x390 net/ipv4/gre_demux.c:163 ip_protocol_deliver_rcu+0x264/0x1300 net/ipv4/ip_input.c:205 ip_local_deliver_finish+0x2b8/0x440 net/ipv4/ip_input.c:233 NF_HOOK include/linux/netfilter.h:314 [inline] ip_local_deliver+0x21f/0x490 net/ipv4/ip_input.c:254 dst_input include/net/dst.h:461 [inline] ip_rcv_finish net/ipv4/ip_input.c:449 [inline] NF_HOOK include/linux/netfilter.h:314 [inline] ip_rcv+0x46f/0x760 net/ipv4/ip_input.c:569 __netif_receive_skb_one_core net/core/dev.c:5534 [inline] __netif_receive_skb+0x1a6/0x5a0 net/core/dev.c:5648 netif_receive_skb_internal net/core/dev.c:5734 [inline] netif_receive_skb+0x58/0x660 net/core/dev.c:5793 tun_rx_batched+0x3ee/0x980 drivers/net/tun.c:1556 tun_get_user+0x53b9/0x66e0 drivers/net/tun.c:2009 tun_chr_write_iter+0x3af/0x5d0 drivers/net/tun.c:2055 call_write_iter include/linux/fs.h:2087 [inline] new_sync_write fs/read_write.c:497 [inline] vfs_write+0xb6b/0x1520 fs/read_write.c:590 ksys_write+0x20f/0x4c0 fs/read_write.c:643 __do_sys_write fs/read_write.c:655 [inline] __se_sys_write fs/read_write.c:652 [inline] __x64_sys_write+0x93/0xd0 fs/read_write.c:652 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b
Uninit was created at: __alloc_pages+0x9a6/0xe00 mm/page_alloc.c:4590 alloc_pages_mpol+0x62b/0x9d0 mm/mempolicy.c:2133 alloc_pages+0x1be/0x1e0 mm/mempolicy.c:2204 skb_page_frag_refill+0x2bf/0x7c0 net/core/sock.c:2909 tun_build_skb drivers/net/tun.c:1686 [inline] tun_get_user+0xe0a/0x66e0 drivers/net/tun.c:1826 tun_chr_write_iter+0x3af/0x5d0 drivers/net/tun.c:2055 call_write_iter include/linux/fs.h:2087 [inline] new_sync_write fs/read_write.c:497 [inline] vfs_write+0xb6b/0x1520 fs/read_write.c:590 ksys_write+0x20f/0x4c0 fs/read_write.c:643 __do_sys_write fs/read_write.c:655 [inline] __se_sys_write fs/read_write.c:652 [inline] __x64_sys_write+0x93/0xd0 fs/read_write.c:652 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b
CVSS Details
- CVSS 3.1 Base Score: 7.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade python-perf-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade bpftoolUpgrade kernel-headersUpgrade kernel-tools-develUpgrade kernel-debuginfoUpgrade kernelUpgrade kernel-develUpgrade perf-debuginfoUpgrade kernel-tools-debuginfoUpgrade kernel-livepatch-5.15.153-100.162Upgrade kernel-toolsUpgrade bpftool-debuginfoUpgrade kernel-livepatch-5.10.214-202.855Upgrade kernel-debuginfo-common-aarch64Upgrade python-perfUpgrade perf | Dec 12, 2024 | Apr 17, 2024 |
| Amazon_linux_2023 | — | Upgrade kernel-debuginfo-common-x86_64Upgrade kernel-headersUpgrade kernel-toolsUpgrade perf-debuginfoUpgrade bpftool-debuginfoUpgrade kernel-modules-extra-commonUpgrade kernel-libbpf-develUpgrade kernel-livepatch-6.1.84-99.169Upgrade kernelUpgrade kernel-tools-debuginfoUpgrade python3-perf-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-develUpgrade perfUpgrade kernel-tools-develUpgrade kernel-debuginfoUpgrade bpftoolUpgrade kernel-libbpf-staticUpgrade python3-perfUpgrade kernel-modules-extraUpgrade kernel-libbpf | Feb 17, 2025 | Apr 17, 2024 |
| Debian | — | Upgrade linux | May 8, 2024 | Apr 17, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade python3-perfUpgrade kernel-abi-stablelistsUpgrade kernelUpgrade kernel-toolsUpgrade kernel-tools-libs | Jul 16, 2024 | Apr 17, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade kernel-toolsUpgrade kernel-tools-libsUpgrade kernel-abi-stablelistsUpgrade python3-perfUpgrade bpftoolUpgrade kernel | Jun 26, 2024 | Apr 17, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade kernel-toolsUpgrade kernel-abi-stablelistsUpgrade python3-perfUpgrade kernel-tools-libsUpgrade kernelUpgrade bpftool | Oct 8, 2024 | Apr 17, 2024 |
| Huawei Euleros 2_0_sp8 | — | Upgrade bpftoolUpgrade kernel-tools-libsUpgrade python-perfUpgrade kernelUpgrade kernel-headersUpgrade kernel-develUpgrade python3-perfUpgrade perfUpgrade kernel-tools | Jul 23, 2024 | Apr 17, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade kernelUpgrade kernel-toolsUpgrade python3-perfUpgrade kernel-tools-libs | Jul 17, 2024 | Apr 17, 2024 |
| Redhat_linux | — | Upgrade kernelNo solution existsUpgrade kernel-rt | Dec 5, 2024 | Apr 17, 2024 |
| Suse | — | Upgrade dtb-marvellUpgrade cluster-md-kmp-64kbUpgrade kernel-azure-optionalUpgrade kernel-debug-develUpgrade gfs2-kmp-defaultUpgrade kernel-default-baseUpgrade kernel-develUpgrade reiserfs-kmp-rtUpgrade gfs2-kmp-azureUpgrade kernel-64kb-develUpgrade dtb-caviumUpgrade ocfs2-kmp-azureUpgrade dtb-rockchipUpgrade kernel-azureUpgrade kernel-defaultUpgrade dtb-hisiliconUpgrade kernel-rt-optionalUpgrade dtb-alteraUpgrade kernel-source-vanillaUpgrade dtb-amdUpgrade kernel-default-livepatch-develUpgrade kernel-docs-htmlUpgrade dtb-appleUpgrade kernel-rt-vdsoUpgrade kselftests-kmp-rtUpgrade dtb-xilinxUpgrade kernel-64kb-extraUpgrade kernel-docsUpgrade kernel-obs-buildUpgrade kernel-rt_debugUpgrade ocfs2-kmp-defaultUpgrade dtb-broadcomUpgrade kernel-default-optionalUpgrade reiserfs-kmp-azureUpgrade dtb-nvidiaUpgrade dtb-socionextUpgrade kernel-debugUpgrade kernel-rt-extraUpgrade cluster-md-kmp-rtUpgrade dtb-sprdUpgrade dtb-renesasUpgrade kernel-source-rtUpgrade kselftests-kmp-azureUpgrade kernel-rt-develUpgrade kernel-debug-vdsoUpgrade dlm-kmp-rtUpgrade dtb-allwinnerUpgrade kernel-rt_debug-develUpgrade kernel-rt-livepatchUpgrade reiserfs-kmp-defaultUpgrade ocfs2-kmp-64kbUpgrade kernel-rt_debug-livepatch-develUpgrade reiserfs-kmp-64kbUpgrade dlm-kmp-defaultUpgrade dtb-qcomUpgrade kernel-sourceUpgrade dtb-mediatekUpgrade kernel-default-livepatchUpgrade kernel-64kbUpgrade ocfs2-kmp-rtUpgrade kselftests-kmp-64kbUpgrade dtb-armUpgrade kernel-rtUpgrade kernel-devel-rtUpgrade kernel-azure-vdsoUpgrade cluster-md-kmp-defaultUpgrade dtb-amlogicUpgrade kernel-kvmsmallUpgrade kernel-default-extraUpgrade dtb-exynosUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-syms-azureUpgrade kernel-symsUpgrade kernel-syms-rtUpgrade kernel-rt-livepatch-develUpgrade kernel-azure-develUpgrade gfs2-kmp-64kbUpgrade dtb-lgUpgrade kernel-source-azureUpgrade kernel-obs-qaUpgrade kernel-default-vdsoUpgrade kernel-default-base-rebuildUpgrade kernel-macrosUpgrade kernel-64kb-optionalUpgrade kernel-default-develUpgrade kernel-azure-extraUpgrade cluster-md-kmp-azureUpgrade kernel-64kb-livepatch-develUpgrade dlm-kmp-azureUpgrade kernel-rt_debug-vdsoUpgrade kernel-devel-azureUpgrade dlm-kmp-64kbUpgrade kernel-kvmsmall-develUpgrade kselftests-kmp-defaultUpgrade kernel-kvmsmall-vdsoUpgrade kernel-debug-livepatch-develUpgrade kernel-azure-livepatch-develUpgrade gfs2-kmp-rtUpgrade dtb-amazonUpgrade dtb-freescaleUpgrade dtb-apmUpgrade kernel-zfcpdump | May 15, 2024 | Apr 17, 2024 |
| Ubuntu | — | Upgrade linux-image-raspiUpgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-5.15.0-1030-xilinx-zynqmpUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-5.15.0-113-genericUpgrade linux-image-aws-hweUpgrade linux-image-generic-hwe-20.04Upgrade linux-image-ibm-lts-24.04Upgrade linux-image-generic-64kUpgrade linux-image-azureUpgrade linux-image-5.4.0-189-generic-lpaeUpgrade linux-image-5.15.0-112-genericUpgrade linux-image-oem-20.04bUpgrade linux-image-6.8.0-1008-gcpUpgrade linux-image-3.13.0-198-lowlatencyUpgrade linux-image-6.8.0-1006-oracle-64kUpgrade linux-image-genericUpgrade linux-image-gkeopUpgrade linux-image-4.15.0-1179-azureUpgrade linux-image-5.4.0-189-genericUpgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-gkeop-5.4Upgrade linux-image-3.13.0-198-genericUpgrade linux-image-ibm-lts-20.04Upgrade linux-image-5.4.0-1047-xilinx-zynqmpUpgrade linux-image-virtual-hwe-20.04Upgrade linux-image-5.4.0-1040-iotUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-aws-lts-20.04Upgrade linux-image-5.4.0-189-lowlatencyUpgrade linux-image-5.15.0-1060-kvmUpgrade linux-image-generic-lts-quantalUpgrade linux-image-6.8.0-35-generic-64kUpgrade linux-image-azure-lts-22.04Upgrade linux-image-5.15.0-1058-nvidia-lowlatencyUpgrade linux-image-5.4.0-1116-kvmUpgrade linux-image-5.15.0-1058-nvidiaUpgrade linux-image-6.8.0-1006-ibmUpgrade linux-image-aws-lts-22.04Upgrade linux-image-4.15.0-227-genericUpgrade linux-image-5.4.0-1132-gcpUpgrade linux-image-5.15.0-112-generic-lpaeUpgrade linux-image-6.8.0-1005-raspiUpgrade linux-image-generic-lts-raringUpgrade linux-image-6.8.0-35-genericUpgrade linux-image-ibm-classicUpgrade linux-image-gke-5.15Upgrade linux-image-5.15.0-113-generic-64kUpgrade linux-image-5.15.0-1061-oracleUpgrade linux-image-azure-fde-lts-22.04Upgrade linux-image-lowlatency-64kUpgrade linux-image-4.4.0-1134-awsUpgrade linux-image-ibmUpgrade linux-image-6.8.0-1006-oracleUpgrade linux-image-5.15.0-1046-gkeopUpgrade linux-image-5.15.0-112-generic-64kUpgrade linux-image-azure-fdeUpgrade linux-image-5.15.0-1062-gcpUpgrade linux-image-6.8.0-1008-azureUpgrade linux-image-5.15.0-110-lowlatencyUpgrade linux-image-nvidiaUpgrade linux-image-5.15.0-113-generic-lpaeUpgrade linux-image-lowlatencyUpgrade linux-image-oem-20.04cUpgrade linux-image-4.4.0-1135-kvmUpgrade linux-image-raspi-nolpaeUpgrade linux-image-5.4.0-1112-raspiUpgrade linux-image-azure-lts-18.04Upgrade linux-image-gcp-lts-22.04Upgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-gcp-lts-20.04Upgrade linux-image-bluefieldUpgrade linux-image-aws-lts-18.04Upgrade linux-image-5.15.0-1065-azure-fdeUpgrade linux-image-kvmUpgrade linux-image-gkeop-5.15Upgrade linux-image-4.15.0-1164-gcpUpgrade linux-image-4.15.0-1154-kvmUpgrade linux-image-oemUpgrade linux-image-5.15.0-1063-awsUpgrade linux-image-raspi2Upgrade linux-image-6.8.0-1006-oemUpgrade linux-image-5.4.0-1075-ibmUpgrade linux-image-6.8.0-1009-awsUpgrade linux-image-5.15.0-1058-raspiUpgrade linux-image-virtual-hwe-18.04Upgrade linux-image-6.8.0-35-lowlatency-64kUpgrade linux-image-oem-24.04aUpgrade linux-image-5.4.0-1127-oracleUpgrade linux-image-oracle-lts-22.04Upgrade linux-image-generic-lts-trustyUpgrade linux-image-5.15.0-1057-ibmUpgrade linux-image-5.15.0-1066-azureUpgrade linux-image-oracle-lts-20.04Upgrade linux-image-oem-24.04Upgrade linux-image-4.15.0-1133-oracleUpgrade linux-image-generic-lts-xenialUpgrade linux-image-virtualUpgrade linux-image-gcp-lts-18.04Upgrade linux-image-generic-hwe-16.04Upgrade linux-image-5.4.0-1088-bluefieldUpgrade linux-image-oem-osp1Upgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-5.15.0-1056-ibmUpgrade linux-image-oracle-lts-18.04Upgrade linux-image-snapdragon-hwe-18.04Upgrade linux-image-5.15.0-110-lowlatency-64kUpgrade linux-image-oem-20.04Upgrade linux-image-4.15.0-1170-awsUpgrade linux-image-6.8.0-35-lowlatencyUpgrade linux-image-oracle-64kUpgrade linux-image-6.8.0-1008-azure-fdeUpgrade linux-image-intel-iotgUpgrade linux-image-intelUpgrade linux-image-generic-lts-saucyUpgrade linux-image-lowlatency-hwe-16.04Upgrade linux-image-azure-lts-20.04Upgrade linux-image-4.4.0-257-genericUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-5.4.0-1133-azureUpgrade linux-image-6.8.0-1004-gkeUpgrade linux-image-oem-20.04dUpgrade linux-image-gkeUpgrade linux-image-xilinx-zynqmpUpgrade linux-image-oracleUpgrade linux-image-gcpUpgrade linux-image-5.15.0-1060-gkeUpgrade linux-image-awsUpgrade linux-image-5.4.0-1095-gkeopUpgrade linux-image-generic-lpaeUpgrade linux-image-virtual-lts-xenialUpgrade linux-image-virtual-hwe-16.04Upgrade linux-image-5.4.0-1128-awsUpgrade linux-image-lowlatency-lts-xenialUpgrade linux-image-serverUpgrade linux-image-5.15.0-1058-intel-iotgUpgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-lowlatency-hwe-18.04Upgrade linux-image-4.4.0-1172-awsUpgrade linux-image-4.4.0-257-lowlatencyUpgrade linux-image-4.15.0-227-lowlatencyUpgrade linux-image-generic-hwe-18.04Upgrade linux-image-raspi-hwe-18.04 | Jul 1, 2024 | Apr 17, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Apr 17, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub