Description
In the Linux kernel, the following vulnerability has been resolved: um: vector: fix use-after-free in vector_mmsg_rx() When vector_mmsg_rx() discards a packet whose overlay header fails verify_header(), it frees the skb and continues the loop: if (header_check < 0) { dev_kfree_skb_irq(skb); vp->estats.rx_encaps_errors++; continue; } The normal and short-packet paths fall through to the bottom of the loop body, which clears the consumed slot and advances the cursors: (*skbuff_vector) = NULL; mmsg_vector++; skbuff_vector++; The verify_header() < 0 path skips that via continue, so the freed skb is left in skbuff_vector[] and the cursors do not advance. The next iteration reads the same slot, gets the freed skb, and frees it again, producing a refcount underflow / use-after-free in the RX path. Discard the slot the same way the other paths do before continuing. Only transports whose verify_header() can return negative are affected: GRE and L2TPv3 do so on a cookie/session-id mismatch (raw/tap do not), so any peer on such a transport can trigger it without authentication.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
49da7e64f33e80edffb1a9eeb230fa4c3f42dffb to < 967c779c9853d2a1cc9cd8e61d300250c348f3d9affected49da7e64f33e80edffb1a9eeb230fa4c3f42dffb to < a7bc015bb798c525e7a82dd14225c6aeb994274baffected49da7e64f33e80edffb1a9eeb230fa4c3f42dffb to < 7dc9781e320d664c9bdd50003c9acfddf363d1e1affected49da7e64f33e80edffb1a9eeb230fa4c3f42dffb to < 4b9601595e8b6b5d18878cac0aeabc687d241111affected49da7e64f33e80edffb1a9eeb230fa4c3f42dffb to < 67d58ab4f2ccf7145f3da07e025735a09c79de1baffected49da7e64f33e80edffb1a9eeb230fa4c3f42dffb to < 180ff4c81faf01ec4e06082c9daa7c40518ead89affected49da7e64f33e80edffb1a9eeb230fa4c3f42dffb to < 804b681002ead233abf49a3efd681f5468a835f9affected49da7e64f33e80edffb1a9eeb230fa4c3f42dffb to < af421e9aed3920c7ac88c24daa48606c7112fecaaffected
Linux Linux
Default version status: affected
4.17affected0 to < 4.17unaffected5.10.265 to ≤ 5.10.*unaffected5.15.216 to ≤ 5.15.*unaffected6.1.183 to ≤ 6.1.*unaffected6.6.151 to ≤ 6.6.*unaffected6.12.103 to ≤ 6.12.*unaffected6.18.44 to ≤ 6.18.*unaffected7.1.8 to ≤ 7.1.*unaffected7.2 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/967c779c9853d2a1cc9cd8e61d300250c348f3d9 ↗
- https://git.kernel.org/stable/c/a7bc015bb798c525e7a82dd14225c6aeb994274b ↗
- https://git.kernel.org/stable/c/7dc9781e320d664c9bdd50003c9acfddf363d1e1 ↗
- https://git.kernel.org/stable/c/4b9601595e8b6b5d18878cac0aeabc687d241111 ↗
- https://git.kernel.org/stable/c/67d58ab4f2ccf7145f3da07e025735a09c79de1b ↗
- https://git.kernel.org/stable/c/180ff4c81faf01ec4e06082c9daa7c40518ead89 ↗
- https://git.kernel.org/stable/c/804b681002ead233abf49a3efd681f5468a835f9 ↗
- https://git.kernel.org/stable/c/af421e9aed3920c7ac88c24daa48606c7112feca ↗