Description
In the Linux kernel, the following vulnerability has been resolved: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() Sashiko found that iptunnel_pmtud_build_icmp() and iptunnel_pmtud_build_icmpv6() were caching ip_hdr() and ipv6_hdr() before an skb_cow() call which can reallocate skb->head. Fix this possible UAF by initializing the local variables after the skb_cow() call. Remove skb_reset_network_header() calls which were not needed.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
4cb47a8644cc9eb8ec81190a50e79e6530d0297f to < 95b6d772bfe788331d9742d73eaa12e113b2adc4affected4cb47a8644cc9eb8ec81190a50e79e6530d0297f to < 7254aef4d1a7e18e887af9010e2f2dc34806789baffected4cb47a8644cc9eb8ec81190a50e79e6530d0297f to < bf8b3f34c37c162357138e7c0942723b8b94fed1affected4cb47a8644cc9eb8ec81190a50e79e6530d0297f to < 76cd9398a0470257ab765bdf5f358a2af2e17934affected4cb47a8644cc9eb8ec81190a50e79e6530d0297f to < 50750d86a2e5266aba0c295483b3397843198b11affected4cb47a8644cc9eb8ec81190a50e79e6530d0297f to < 6dff77899b9e9fe5d854abda3a98ad04e7229ef7affected4cb47a8644cc9eb8ec81190a50e79e6530d0297f to < f3f204541f280a6ecb04503a0d6794d93990ca43affected4cb47a8644cc9eb8ec81190a50e79e6530d0297f to < b4bc94353050b1fa7b702bd4c6600710dd926cffaffected
Linux Linux
Default version status: affected
5.9affected0 to < 5.9unaffected5.10.259 to ≤ 5.10.*unaffected5.15.210 to ≤ 5.15.*unaffected6.1.176 to ≤ 6.1.*unaffected6.6.143 to ≤ 6.6.*unaffected6.12.93 to ≤ 6.12.*unaffected6.18.35 to ≤ 6.18.*unaffected7.0.12 to ≤ 7.0.*unaffected7.1 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/95b6d772bfe788331d9742d73eaa12e113b2adc4 ↗
- https://git.kernel.org/stable/c/7254aef4d1a7e18e887af9010e2f2dc34806789b ↗
- https://git.kernel.org/stable/c/bf8b3f34c37c162357138e7c0942723b8b94fed1 ↗
- https://git.kernel.org/stable/c/76cd9398a0470257ab765bdf5f358a2af2e17934 ↗
- https://git.kernel.org/stable/c/50750d86a2e5266aba0c295483b3397843198b11 ↗
- https://git.kernel.org/stable/c/6dff77899b9e9fe5d854abda3a98ad04e7229ef7 ↗
- https://git.kernel.org/stable/c/f3f204541f280a6ecb04503a0d6794d93990ca43 ↗
- https://git.kernel.org/stable/c/b4bc94353050b1fa7b702bd4c6600710dd926cff ↗