Description (CNA)
In the Linux kernel, the following vulnerability has been resolved: um: vector: fix use-after-free in vector_mmsg_rx() When vector_mmsg_rx() discards a packet whose overlay header fails verify_header(), it frees the skb and continues the loop: if (header_check < 0) { dev_kfree_skb_irq(skb); vp->estats.rx_encaps_errors++; continue; } The normal and short-packet paths fall through to the bottom of the loop body, which clears the consumed slot and advances the cursors: (*skbuff_vector) = NULL; mmsg_vector++; skbuff_vector++; The verify_header() < 0 path skips that via continue, so the freed skb is left in skbuff_vector[] and the cursors do not advance. The next iteration reads the same slot, gets the freed skb, and frees it again, producing a refcount underflow / use-after-free in the RX path. Discard the slot the same way the other paths do before continuing. Only transports whose verify_header() can return negative are affected: GRE and L2TPv3 do so on a cookie/session-id mismatch (raw/tap do not), so any peer on such a transport can trigger it without authentication.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Linux / Linux | affected 49da7e64f33e80edffb1a9eeb230fa4c3f42dffb before 967c779c9853d2a1cc9cd8e61d300250c348f3d9; affected 49da7e64f33e80edffb1a9eeb230fa4c3f42dffb before a7bc015bb798c525e7a82dd14225c6aeb994274b; affected 49da7e64f33e80edffb1a9eeb230fa4c3f42dffb before 7dc9781e320d664c9bdd50003c9acfddf363d1e1; affected 49da7e64f33e80edffb1a9eeb230fa4c3f42dffb before 4b9601595e8b6b5d18878cac0aeabc687d241111; affected 49da7e64f33e80edffb1a9eeb230fa4c3f42dffb before 67d58ab4f2ccf7145f3da07e025735a09c79de1b; affected 49da7e64f33e80edffb1a9eeb230fa4c3f42dffb before 180ff4c81faf01ec4e06082c9daa7c40518ead89; affected 49da7e64f33e80edffb1a9eeb230fa4c3f42dffb before 804b681002ead233abf49a3efd681f5468a835f9; affected 49da7e64f33e80edffb1a9eeb230fa4c3f42dffb before af421e9aed3920c7ac88c24daa48606c7112feca |
| Linux / Linux | affected 4.17; unaffected 0 before 4.17; unaffected 5.10.265 through 5.10.*; unaffected 5.15.216 through 5.15.*; unaffected 6.1.183 through 6.1.*; unaffected 6.6.151 through 6.6.*; unaffected 6.12.103 through 6.12.*; unaffected 6.18.44 through 6.18.*; unaffected 7.1.8 through 7.1.*; unaffected 7.2 through * |
CWE
No CWE identifiers supplied.
References
- https://git.kernel.org/stable/c/967c779c9853d2a1cc9cd8e61d300250c348f3d9
- https://git.kernel.org/stable/c/a7bc015bb798c525e7a82dd14225c6aeb994274b
- https://git.kernel.org/stable/c/7dc9781e320d664c9bdd50003c9acfddf363d1e1
- https://git.kernel.org/stable/c/4b9601595e8b6b5d18878cac0aeabc687d241111
- https://git.kernel.org/stable/c/67d58ab4f2ccf7145f3da07e025735a09c79de1b
- https://git.kernel.org/stable/c/180ff4c81faf01ec4e06082c9daa7c40518ead89
- https://git.kernel.org/stable/c/804b681002ead233abf49a3efd681f5468a835f9
- https://git.kernel.org/stable/c/af421e9aed3920c7ac88c24daa48606c7112feca