Description
In the Linux kernel, the following vulnerability has been resolved: seg6: separate dst_cache for input and output paths in seg6 lwtunnel The seg6 lwtunnel uses a single dst_cache per encap route, shared between seg6_input_core() and seg6_output_core(). These two paths can perform the post-encap SID lookup in different routing contexts (e.g., ip rules matching on the ingress interface, or VRF table separation). Whichever path runs first populates the cache, and the other reuses it blindly, bypassing its own lookup. Fix this by splitting the cache into cache_input and cache_output, so each path maintains its own cached dst independently.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
6c8702c60b88651072460f3f4026c7dfe2521d12 to < 1dec91d3b1cefb82635761b7812154af3ef46449affected6c8702c60b88651072460f3f4026c7dfe2521d12 to < 750569d6987a0ff46317a4b86eb3907e296287bfaffected6c8702c60b88651072460f3f4026c7dfe2521d12 to < 57d0374d14fa667dec6952173b93e7e84486d5c9affected6c8702c60b88651072460f3f4026c7dfe2521d12 to < 84d458018b147176b259347103fccb7e93abd2b1affected6c8702c60b88651072460f3f4026c7dfe2521d12 to < 6305ad032b03d2ea4181b953a66e19a9a6ed053caffected6c8702c60b88651072460f3f4026c7dfe2521d12 to < fb56de5d99218de49d5d43ef3a99e062ecd0f9a1affected6c8702c60b88651072460f3f4026c7dfe2521d12 to < 17d87d42874f5d6c1a0ccc6d9190dfe82a9a7a6aaffected6c8702c60b88651072460f3f4026c7dfe2521d12 to < c3812651b522fe8437ebb7063b75ddb95b571643affected
Linux Linux
Default version status: affected
4.10affected0 to < 4.10unaffected5.10.253 to ≤ 5.10.*unaffected5.15.203 to ≤ 5.15.*unaffected6.1.169 to ≤ 6.1.*unaffected6.6.135 to ≤ 6.6.*unaffected6.12.82 to ≤ 6.12.*unaffected6.18.23 to ≤ 6.18.*unaffected6.19.13 to ≤ 6.19.*unaffected7.0 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/1dec91d3b1cefb82635761b7812154af3ef46449 ↗
- https://git.kernel.org/stable/c/750569d6987a0ff46317a4b86eb3907e296287bf ↗
- https://git.kernel.org/stable/c/57d0374d14fa667dec6952173b93e7e84486d5c9 ↗
- https://git.kernel.org/stable/c/84d458018b147176b259347103fccb7e93abd2b1 ↗
- https://git.kernel.org/stable/c/6305ad032b03d2ea4181b953a66e19a9a6ed053c ↗
- https://git.kernel.org/stable/c/fb56de5d99218de49d5d43ef3a99e062ecd0f9a1 ↗
- https://git.kernel.org/stable/c/17d87d42874f5d6c1a0ccc6d9190dfe82a9a7a6a ↗
- https://git.kernel.org/stable/c/c3812651b522fe8437ebb7063b75ddb95b571643 ↗