Description
In the Linux kernel, the following vulnerability has been resolved: ip_gre: Reject enabling collect metadata through changelink ipgre_netlink_parms() can enable collect_md on an existing GRE, GRETAP or ERSPAN device. Unlike newlink, changelink does not enforce metadata tunnel uniqueness. Converting a non-metadata device can therefore replace the metadata receive entry for another device of the same type in the same netns. Deleting either device then clears the shared entry, breaking metadata receive lookup for the surviving device. If parameter validation fails after collect_md is set, deleting the modified device can also clear an entry it never owned. Reject enabling metadata mode in both changelink callbacks before any encapsulation or tunnel parameters are modified. Allow requests that repeat the metadata attribute on an existing metadata device.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
2e15ea390e6f4466655066d97e22ec66870a042c to < c80315da84998b69b8829785a174b0bf72a81992affected2e15ea390e6f4466655066d97e22ec66870a042c to < cff8b520312e750ad38967c30128e1534cbf9484affected2e15ea390e6f4466655066d97e22ec66870a042c to < 1dc759571f3df14891175fc52527f7624ba01322affected2e15ea390e6f4466655066d97e22ec66870a042c to < da2e0cfbb620b199927a1e5b93b7cfde32083c7daffected2e15ea390e6f4466655066d97e22ec66870a042c to < 2e54d53b65e296b4b4bdc2cdd3b2b58dfa8d8c5caffected2e15ea390e6f4466655066d97e22ec66870a042c to < bdd41b96e814300c66222cf4e47ecb8aef995656affected2e15ea390e6f4466655066d97e22ec66870a042c to < 63c5e48d6f7f5722a48f63e13e961dc5302894edaffected2e15ea390e6f4466655066d97e22ec66870a042c to < a3f315be9d30eeb6938d11fa17fd4b32d52f7c42affected
Linux Linux
Default version status: affected
4.3affected0 to < 4.3unaffected5.10.271 to ≤ 5.10.*unaffected5.15.222 to ≤ 5.15.*unaffected6.1.189 to ≤ 6.1.*unaffected6.6.158 to ≤ 6.6.*unaffected6.12.112 to ≤ 6.12.*unaffected6.18.55 to ≤ 6.18.*unaffected7.2.9 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/c80315da84998b69b8829785a174b0bf72a81992 ↗
- https://git.kernel.org/stable/c/cff8b520312e750ad38967c30128e1534cbf9484 ↗
- https://git.kernel.org/stable/c/1dc759571f3df14891175fc52527f7624ba01322 ↗
- https://git.kernel.org/stable/c/da2e0cfbb620b199927a1e5b93b7cfde32083c7d ↗
- https://git.kernel.org/stable/c/2e54d53b65e296b4b4bdc2cdd3b2b58dfa8d8c5c ↗
- https://git.kernel.org/stable/c/bdd41b96e814300c66222cf4e47ecb8aef995656 ↗
- https://git.kernel.org/stable/c/63c5e48d6f7f5722a48f63e13e961dc5302894ed ↗
- https://git.kernel.org/stable/c/a3f315be9d30eeb6938d11fa17fd4b32d52f7c42 ↗