Description
In the Linux kernel, the following vulnerability has been resolved: net: cap advertised IP tunnel headroom IP tunnel devices derive their advertised needed_headroom from lower output devices. A stack of user-created devices can make the derived value larger than the 16-bit skb header offsets can represent. Once IP output reserves it, skb head expansion can wrap those offsets. The runtime transmit path already caps a growing needed_headroom at 512. Apply the same cap when tunnel configuration publishes needed_headroom derived from a lower output device. Capping the advertised value is safe: IP tunnel transmit still expands the skb when a packet needs more headroom. A nonsensical stacked configuration can therefore incur an extra reallocation, but it cannot publish an unbounded reservation to upper layers.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
1a37e412a0225fcba5587f24c0dfc7636efc8b69 to < fb889a619723032140f5d983a3a34d25a5a2bed4affected1a37e412a0225fcba5587f24c0dfc7636efc8b69 to < b160422f8103574425e2834130e169d84c94fa1daffected1a37e412a0225fcba5587f24c0dfc7636efc8b69 to < d36e75f5669140b66515ad3a176ca6337bd80a5eaffected1a37e412a0225fcba5587f24c0dfc7636efc8b69 to < 84783961cb8bdb36b4f41a02ce43aafc6d52b176affected1a37e412a0225fcba5587f24c0dfc7636efc8b69 to < bc4e05ae66c9797a0972ac44326e69c5305e0020affected1a37e412a0225fcba5587f24c0dfc7636efc8b69 to < af0ee8f04bea22cdb331fa3509e17f81b48938adaffected1a37e412a0225fcba5587f24c0dfc7636efc8b69 to < 9144f2c53a04465a6878172b523f640313c5559eaffected1a37e412a0225fcba5587f24c0dfc7636efc8b69 to < 6b222adeb9340306e2ff97127c76117abb9b3df8affected
Linux Linux
Default version status: affected
3.11affected0 to < 3.11unaffected5.10.270 to ≤ 5.10.*unaffected5.15.221 to ≤ 5.15.*unaffected6.1.188 to ≤ 6.1.*unaffected6.6.157 to ≤ 6.6.*unaffected6.12.109 to ≤ 6.12.*unaffected6.18.50 to ≤ 6.18.*unaffected7.2.4 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/fb889a619723032140f5d983a3a34d25a5a2bed4 ↗
- https://git.kernel.org/stable/c/b160422f8103574425e2834130e169d84c94fa1d ↗
- https://git.kernel.org/stable/c/d36e75f5669140b66515ad3a176ca6337bd80a5e ↗
- https://git.kernel.org/stable/c/84783961cb8bdb36b4f41a02ce43aafc6d52b176 ↗
- https://git.kernel.org/stable/c/bc4e05ae66c9797a0972ac44326e69c5305e0020 ↗
- https://git.kernel.org/stable/c/af0ee8f04bea22cdb331fa3509e17f81b48938ad ↗
- https://git.kernel.org/stable/c/9144f2c53a04465a6878172b523f640313c5559e ↗
- https://git.kernel.org/stable/c/6b222adeb9340306e2ff97127c76117abb9b3df8 ↗