Description
In the Linux kernel, the following vulnerability has been resolved: ipv6: xfrm6: release dst on error in xfrm6_rcv_encap() xfrm6_rcv_encap() performs an IPv6 route lookup when the skb does not already have a dst attached. ip6_route_input_lookup() returns a referenced dst entry even when the lookup resolves to an error route. If dst->error is set, xfrm6_rcv_encap() drops the skb without attaching the dst to the skb and without releasing the reference returned by the lookup. Repeated packets hitting this path therefore leak dst entries. Release the dst before jumping to the drop path.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
0146dca70b877b73c5fd9c67912b8a0ca8a7bac7 to < a0721bcd72641c32b281f227a94505b31cf54117affected0146dca70b877b73c5fd9c67912b8a0ca8a7bac7 to < a20b34f6e854fe6f2aa82528fae7a88759919eb4affected0146dca70b877b73c5fd9c67912b8a0ca8a7bac7 to < 870560015ce6e0d8f841c6a8aba33c44be52c727affected0146dca70b877b73c5fd9c67912b8a0ca8a7bac7 to < c2efc4956981066df2fef1cc77391b523db6d8e4affected0146dca70b877b73c5fd9c67912b8a0ca8a7bac7 to < 554c9b090c8ac5b1c5c507f4badf8d5d0c9c6e13affected0146dca70b877b73c5fd9c67912b8a0ca8a7bac7 to < 9d5047782f9bd2829e529df69209bf3232eb561faffected0146dca70b877b73c5fd9c67912b8a0ca8a7bac7 to < 6a5eec0a2a0e99ec9743cf8f1c4082178811d90aaffected0146dca70b877b73c5fd9c67912b8a0ca8a7bac7 to < bc0fcb9823cd0894934cf968b525c575833d7078affected
Linux Linux
Default version status: affected
5.8affected0 to < 5.8unaffected5.10.258 to ≤ 5.10.*unaffected5.15.209 to ≤ 5.15.*unaffected6.1.175 to ≤ 6.1.*unaffected6.6.140 to ≤ 6.6.*unaffected6.12.88 to ≤ 6.12.*unaffected6.18.30 to ≤ 6.18.*unaffected7.0.7 to ≤ 7.0.*unaffected7.1 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/a0721bcd72641c32b281f227a94505b31cf54117 ↗
- https://git.kernel.org/stable/c/a20b34f6e854fe6f2aa82528fae7a88759919eb4 ↗
- https://git.kernel.org/stable/c/870560015ce6e0d8f841c6a8aba33c44be52c727 ↗
- https://git.kernel.org/stable/c/c2efc4956981066df2fef1cc77391b523db6d8e4 ↗
- https://git.kernel.org/stable/c/554c9b090c8ac5b1c5c507f4badf8d5d0c9c6e13 ↗
- https://git.kernel.org/stable/c/9d5047782f9bd2829e529df69209bf3232eb561f ↗
- https://git.kernel.org/stable/c/6a5eec0a2a0e99ec9743cf8f1c4082178811d90a ↗
- https://git.kernel.org/stable/c/bc0fcb9823cd0894934cf968b525c575833d7078 ↗
- https://cert-portal.siemens.com/productcert/html/ssa-019113.html ↗
- https://cert-portal.siemens.com/productcert/html/ssa-457936.html ↗
- https://cert-portal.siemens.com/productcert/html/ssa-784472.html ↗