In the Linux kernel, the following vulnerability has been resolved:
net: ip_tunnel: make sure to pull inner header in ip_tunnel_rcv()
Apply the same fix than ones found in :
8d975c15c0cd ("ip6_tunnel: make sure to pull inner header in __ip6_tnl_rcv()") 1ca1ba465e55 ("geneve: make sure to pull inner header in geneve_rx()")
We have to save skb->network_header in a temporary variable in order to be able to recompute the network_header pointer after a pskb_inet_may_pull() call.
pskb_inet_may_pull() makes sure the needed headers are in skb->head.
syzbot reported: BUG: KMSAN: uninit-value in __INET_ECN_decapsulate include/net/inet_ecn.h:253 [inline] BUG: KMSAN: uninit-value in INET_ECN_decapsulate include/net/inet_ecn.h:275 [inline] BUG: KMSAN: uninit-value in IP_ECN_decapsulate include/net/inet_ecn.h:302 [inline] BUG: KMSAN: uninit-value in ip_tunnel_rcv+0xed9/0x2ed0 net/ipv4/ip_tunnel.c:409 __INET_ECN_decapsulate include/net/inet_ecn.h:253 [inline] INET_ECN_decapsulate include/net/inet_ecn.h:275 [inline] IP_ECN_decapsulate include/net/inet_ecn.h:302 [inline] ip_tunnel_rcv+0xed9/0x2ed0 net/ipv4/ip_tunnel.c:409 __ipgre_rcv+0x9bc/0xbc0 net/ipv4/ip_gre.c:389 ipgre_rcv net/ipv4/ip_gre.c:411 [inline] gre_rcv+0x423/0x19f0 net/ipv4/ip_gre.c:447 gre_rcv+0x2a4/0x390 net/ipv4/gre_demux.c:163 ip_protocol_deliver_rcu+0x264/0x1300 net/ipv4/ip_input.c:205 ip_local_deliver_finish+0x2b8/0x440 net/ipv4/ip_input.c:233 NF_HOOK include/linux/netfilter.h:314 [inline] ip_local_deliver+0x21f/0x490 net/ipv4/ip_input.c:254 dst_input include/net/dst.h:461 [inline] ip_rcv_finish net/ipv4/ip_input.c:449 [inline] NF_HOOK include/linux/netfilter.h:314 [inline] ip_rcv+0x46f/0x760 net/ipv4/ip_input.c:569 __netif_receive_skb_one_core net/core/dev.c:5534 [inline] __netif_receive_skb+0x1a6/0x5a0 net/core/dev.c:5648 netif_receive_skb_internal net/core/dev.c:5734 [inline] netif_receive_skb+0x58/0x660 net/core/dev.c:5793 tun_rx_batched+0x3ee/0x980 drivers/net/tun.c:1556 tun_get_user+0x53b9/0x66e0 drivers/net/tun.c:2009 tun_chr_write_iter+0x3af/0x5d0 drivers/net/tun.c:2055 call_write_iter include/linux/fs.h:2087 [inline] new_sync_write fs/read_write.c:497 [inline] vfs_write+0xb6b/0x1520 fs/read_write.c:590 ksys_write+0x20f/0x4c0 fs/read_write.c:643 __do_sys_write fs/read_write.c:655 [inline] __se_sys_write fs/read_write.c:652 [inline] __x64_sys_write+0x93/0xd0 fs/read_write.c:652 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b
Uninit was created at: __alloc_pages+0x9a6/0xe00 mm/page_alloc.c:4590 alloc_pages_mpol+0x62b/0x9d0 mm/mempolicy.c:2133 alloc_pages+0x1be/0x1e0 mm/mempolicy.c:2204 skb_page_frag_refill+0x2bf/0x7c0 net/core/sock.c:2909 tun_build_skb drivers/net/tun.c:1686 [inline] tun_get_user+0xe0a/0x66e0 drivers/net/tun.c:1826 tun_chr_write_iter+0x3af/0x5d0 drivers/net/tun.c:2055 call_write_iter include/linux/fs.h:2087 [inline] new_sync_write fs/read_write.c:497 [inline] vfs_write+0xb6b/0x1520 fs/read_write.c:590 ksys_write+0x20f/0x4c0 fs/read_write.c:643 __do_sys_write fs/read_write.c:655 [inline] __se_sys_write fs/read_write.c:652 [inline] __x64_sys_write+0x93/0xd0 fs/read_write.c:652 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b
CVSS Details
- CVSS 3.1 Base Score: 7.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade kernel-headersUpgrade kernelUpgrade bpftoolUpgrade python-perf-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-tools-develUpgrade kernel-debuginfoUpgrade kernel-develUpgrade kernel-tools-debuginfoUpgrade bpftool-debuginfoUpgrade python-perfUpgrade kernel-livepatch-5.10.214-202.855Upgrade kernel-debuginfo-common-aarch64Upgrade kernel-livepatch-5.15.153-100.162Upgrade perf-debuginfoUpgrade kernel-toolsUpgrade perf | Dec 12, 2024 | Apr 17, 2024 |
| Amazon_linux_2023 | — | Upgrade kernel-livepatch-6.1.84-99.169Upgrade bpftool-debuginfoUpgrade kernelUpgrade kernel-headersUpgrade kernel-modules-extra-commonUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-libbpf-develUpgrade kernel-toolsUpgrade perf-debuginfoUpgrade perfUpgrade kernel-libbpfUpgrade python3-perfUpgrade kernel-modules-extraUpgrade kernel-tools-debuginfoUpgrade kernel-develUpgrade python3-perf-debuginfoUpgrade kernel-libbpf-staticUpgrade kernel-debuginfoUpgrade kernel-tools-develUpgrade bpftoolUpgrade kernel-debuginfo-common-aarch64 | Feb 17, 2025 | Apr 17, 2024 |
| Debian | — | Upgrade linux | May 8, 2024 | Apr 17, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade python3-perfUpgrade kernelUpgrade kernel-abi-stablelistsUpgrade kernel-tools-libsUpgrade kernel-tools | Jul 16, 2024 | Apr 17, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade kernelUpgrade bpftoolUpgrade python3-perfUpgrade kernel-abi-stablelistsUpgrade kernel-toolsUpgrade kernel-tools-libs | Jun 26, 2024 | Apr 17, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade kernel-toolsUpgrade kernel-abi-stablelistsUpgrade python3-perfUpgrade kernel-tools-libsUpgrade kernelUpgrade bpftool | Oct 8, 2024 | Apr 17, 2024 |
| Huawei Euleros 2_0_sp8 | — | Upgrade perfUpgrade kernel-develUpgrade python3-perfUpgrade kernel-toolsUpgrade kernel-tools-libsUpgrade bpftoolUpgrade kernel-headersUpgrade kernelUpgrade python-perf | Jul 23, 2024 | Apr 17, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade kernel-toolsUpgrade kernelUpgrade python3-perfUpgrade kernel-tools-libs | Jul 17, 2024 | Apr 17, 2024 |
| Redhat_linux | — | Upgrade kernel-rtNo solution existsUpgrade kernel | Dec 5, 2024 | Apr 17, 2024 |
| Suse | — | Upgrade dtb-armUpgrade cluster-md-kmp-defaultUpgrade kselftests-kmp-64kbUpgrade kernel-kvmsmallUpgrade ocfs2-kmp-rtUpgrade dtb-qcomUpgrade kernel-rt-livepatch-develUpgrade kernel-devel-azureUpgrade kernel-default-base-rebuildUpgrade kernel-macrosUpgrade dlm-kmp-64kbUpgrade kernel-azure-develUpgrade kernel-rt_debug-vdsoUpgrade kernel-64kb-livepatch-develUpgrade kernel-default-develUpgrade kernel-default-livepatchUpgrade kernel-azure-livepatch-develUpgrade kernel-64kb-optionalUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-kvmsmall-develUpgrade kernel-symsUpgrade kernel-kvmsmall-vdsoUpgrade kernel-syms-rtUpgrade kernel-default-extraUpgrade kselftests-kmp-defaultUpgrade cluster-md-kmp-azureUpgrade kernel-zfcpdumpUpgrade dtb-apmUpgrade kernel-64kbUpgrade kernel-syms-azureUpgrade dtb-exynosUpgrade gfs2-kmp-rtUpgrade kernel-default-vdsoUpgrade dtb-lgUpgrade dtb-mediatekUpgrade kernel-azure-extraUpgrade dtb-amlogicUpgrade kernel-debug-livepatch-develUpgrade gfs2-kmp-64kbUpgrade kernel-obs-qaUpgrade kernel-rtUpgrade kernel-azure-vdsoUpgrade kernel-sourceUpgrade dlm-kmp-azureUpgrade kernel-devel-rtUpgrade dtb-amazonUpgrade kernel-source-azureUpgrade dtb-freescaleUpgrade reiserfs-kmp-rtUpgrade reiserfs-kmp-defaultUpgrade dlm-kmp-rtUpgrade kernel-obs-buildUpgrade dtb-socionextUpgrade kselftests-kmp-rtUpgrade kernel-rt_debugUpgrade kernel-docsUpgrade kernel-develUpgrade kernel-default-baseUpgrade gfs2-kmp-defaultUpgrade dtb-hisiliconUpgrade cluster-md-kmp-rtUpgrade gfs2-kmp-azureUpgrade kernel-64kb-develUpgrade kernel-source-vanillaUpgrade kernel-docs-htmlUpgrade kernel-default-livepatch-develUpgrade kernel-debugUpgrade ocfs2-kmp-azureUpgrade kernel-rt-extraUpgrade kernel-debug-develUpgrade kernel-azure-optionalUpgrade dtb-caviumUpgrade kernel-rt-vdsoUpgrade dtb-broadcomUpgrade kernel-64kb-extraUpgrade reiserfs-kmp-azureUpgrade dtb-renesasUpgrade dtb-amdUpgrade kselftests-kmp-azureUpgrade kernel-source-rtUpgrade ocfs2-kmp-64kbUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-rt_debug-develUpgrade kernel-rt-develUpgrade kernel-debug-vdsoUpgrade dtb-allwinnerUpgrade reiserfs-kmp-64kbUpgrade dtb-appleUpgrade dtb-alteraUpgrade kernel-defaultUpgrade kernel-azureUpgrade kernel-default-optionalUpgrade kernel-rt-livepatchUpgrade dtb-xilinxUpgrade dtb-sprdUpgrade dtb-nvidiaUpgrade dtb-marvellUpgrade cluster-md-kmp-64kbUpgrade ocfs2-kmp-defaultUpgrade dtb-rockchipUpgrade dlm-kmp-defaultUpgrade kernel-rt-optional | May 15, 2024 | Apr 17, 2024 |
| Ubuntu | — | Upgrade linux-image-bluefieldUpgrade linux-image-5.15.0-1065-azure-fdeUpgrade linux-image-4.15.0-227-lowlatencyUpgrade linux-image-serverUpgrade linux-image-4.4.0-1172-awsUpgrade linux-image-oem-24.04Upgrade linux-image-kvmUpgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-lowlatency-lts-xenialUpgrade linux-image-generic-lts-saucyUpgrade linux-image-raspi2Upgrade linux-image-gcp-lts-20.04Upgrade linux-image-intelUpgrade linux-image-lowlatency-hwe-16.04Upgrade linux-image-5.15.0-1058-intel-iotgUpgrade linux-image-lowlatency-hwe-18.04Upgrade linux-image-oem-24.04aUpgrade linux-image-4.15.0-1170-awsUpgrade linux-image-gcp-lts-22.04Upgrade linux-image-oracle-lts-22.04Upgrade linux-image-5.15.0-1057-ibmUpgrade linux-image-4.4.0-1135-kvmUpgrade linux-image-generic-lts-xenialUpgrade linux-image-raspi-nolpaeUpgrade linux-image-6.8.0-35-lowlatency-64kUpgrade linux-image-6.8.0-1009-awsUpgrade linux-image-virtualUpgrade linux-image-oracle-lts-20.04Upgrade linux-image-5.4.0-1127-oracleUpgrade linux-image-4.15.0-1133-oracleUpgrade linux-image-generic-hwe-16.04Upgrade linux-image-5.15.0-1066-azureUpgrade linux-image-5.15.0-1058-raspiUpgrade linux-image-virtual-hwe-18.04Upgrade linux-image-5.4.0-1075-ibmUpgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-4.4.0-257-lowlatencyUpgrade linux-image-aws-lts-18.04Upgrade linux-image-generic-hwe-18.04Upgrade linux-image-4.15.0-1154-kvmUpgrade linux-image-5.15.0-1056-ibmUpgrade linux-image-5.15.0-110-lowlatency-64kUpgrade linux-image-virtual-lts-xenialUpgrade linux-image-oem-20.04Upgrade linux-image-gcpUpgrade linux-image-oem-20.04dUpgrade linux-image-5.4.0-1112-raspiUpgrade linux-image-4.15.0-1164-gcpUpgrade linux-image-raspi-hwe-18.04Upgrade linux-image-generic-lts-trustyUpgrade linux-image-virtual-hwe-16.04Upgrade linux-image-gkeUpgrade linux-image-gkeop-5.15Upgrade linux-image-xilinx-zynqmpUpgrade linux-image-6.8.0-35-lowlatencyUpgrade linux-image-oracle-64kUpgrade linux-image-4.4.0-257-genericUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-6.8.0-1008-azure-fdeUpgrade linux-image-azure-lts-18.04Upgrade linux-image-5.4.0-1133-azureUpgrade linux-image-azure-lts-20.04Upgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-oemUpgrade linux-image-gcp-lts-18.04Upgrade linux-image-snapdragon-hwe-18.04Upgrade linux-image-6.8.0-1006-oemUpgrade linux-image-oracle-lts-18.04Upgrade linux-image-5.15.0-1063-awsUpgrade linux-image-oem-osp1Upgrade linux-image-5.4.0-1128-awsUpgrade linux-image-5.4.0-1088-bluefieldUpgrade linux-image-6.8.0-1004-gkeUpgrade linux-image-oracleUpgrade linux-image-5.4.0-1095-gkeopUpgrade linux-image-awsUpgrade linux-image-generic-lpaeUpgrade linux-image-intel-iotgUpgrade linux-image-5.15.0-1060-gkeUpgrade linux-image-azure-lts-22.04Upgrade linux-image-4.15.0-1179-azureUpgrade linux-image-raspiUpgrade linux-image-5.4.0-189-generic-lpaeUpgrade linux-image-5.15.0-1060-kvmUpgrade linux-image-5.15.0-112-genericUpgrade linux-image-5.15.0-113-generic-lpaeUpgrade linux-image-5.4.0-1132-gcpUpgrade linux-image-5.15.0-112-generic-64kUpgrade linux-image-azureUpgrade linux-image-generic-64kUpgrade linux-image-6.8.0-1008-azureUpgrade linux-image-oem-20.04bUpgrade linux-image-ibm-lts-20.04Upgrade linux-image-aws-hweUpgrade linux-image-lowlatency-64kUpgrade linux-image-generic-hwe-20.04Upgrade linux-image-5.15.0-1058-nvidia-lowlatencyUpgrade linux-image-5.15.0-1030-xilinx-zynqmpUpgrade linux-image-6.8.0-35-genericUpgrade linux-image-gkeop-5.4Upgrade linux-image-gkeopUpgrade linux-image-5.15.0-113-generic-64kUpgrade linux-image-ibm-classicUpgrade linux-image-6.8.0-1006-oracle-64kUpgrade linux-image-5.4.0-189-genericUpgrade linux-image-nvidiaUpgrade linux-image-oem-20.04cUpgrade linux-image-3.13.0-198-lowlatencyUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-5.4.0-1040-iotUpgrade linux-image-6.8.0-1008-gcpUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-5.15.0-1058-nvidiaUpgrade linux-image-aws-lts-22.04Upgrade linux-image-4.15.0-227-genericUpgrade linux-image-generic-lts-quantalUpgrade linux-image-gke-5.15Upgrade linux-image-6.8.0-35-generic-64kUpgrade linux-image-5.4.0-189-lowlatencyUpgrade linux-image-aws-lts-20.04Upgrade linux-image-6.8.0-1005-raspiUpgrade linux-image-6.8.0-1006-oracleUpgrade linux-image-generic-lts-raringUpgrade linux-image-5.15.0-1062-gcpUpgrade linux-image-4.4.0-1134-awsUpgrade linux-image-lowlatencyUpgrade linux-image-azure-fdeUpgrade linux-image-ibmUpgrade linux-image-5.15.0-110-lowlatencyUpgrade linux-image-azure-fde-lts-22.04Upgrade linux-image-3.13.0-198-genericUpgrade linux-image-5.15.0-112-generic-lpaeUpgrade linux-image-virtual-hwe-20.04Upgrade linux-image-5.4.0-1116-kvmUpgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-genericUpgrade linux-image-5.4.0-1047-xilinx-zynqmpUpgrade linux-image-5.15.0-1061-oracleUpgrade linux-image-5.15.0-113-genericUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-6.8.0-1006-ibmUpgrade linux-image-5.15.0-1046-gkeop | Jul 1, 2024 | Apr 17, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Apr 17, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub