Description
In the Linux kernel, the following vulnerability has been resolved: ip6_gre: remove obsolete ERSPAN PMTU update A tc tunnel_key action can attach a METADATA_IP_TUNNEL dst to an skb, and mirred can redirect it to a native ip6erspan device. The legacy PMTU update in ip6erspan_tunnel_xmit() treats that metadata dst as a route. Since it has no output device, dst_dev(dst)->mtu dereferences NULL. On v7.2 with KASAN, an initial UID/GID 65534 process with CapEff 0 used self-created user and network namespaces to trigger: KASAN: null-ptr-deref RIP: ip6erspan_tunnel_xmit+0x10fc/0x2cc0 Kernel panic - not syncing: Fatal exception in interrupt The update is obsolete. Commit fe1a4ca0a2b7 ("ip6_gre: process toobig in a better way") changed IPv6 GRE Too Big handling to update the underlay route and removed the equivalent block from __gre6_xmit(). ip6_tnl_xmit() then propagates the underlay PMTU to the overlay route. Remove the stale ERSPAN copy and its now-unused dst variable. This eliminates the metadata-dst dereference and keeps ERSPAN aligned with IPv6 GRE PMTU handling.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
5a963eb61b7c39e6c422b6e48619d19d04719358 to < b14a682ad7d45345701e08f9279d483a1da8b36caffected5a963eb61b7c39e6c422b6e48619d19d04719358 to < f5b143f4cd3fb7673df8d727550478a4b762908aaffected5a963eb61b7c39e6c422b6e48619d19d04719358 to < 2d06cb25a497d3a7034ef9d172626c2d6620a0f1affected5a963eb61b7c39e6c422b6e48619d19d04719358 to < 8f27260b989f488760289276377db24fbfb20bfaaffected5a963eb61b7c39e6c422b6e48619d19d04719358 to < 8bc60db48e8cba35488bbd6e1f94aa990afa275aaffected
Linux Linux
Default version status: affected
4.16affected0 to < 4.16unaffected6.6.160 to ≤ 6.6.*unaffected6.12.114 to ≤ 6.12.*unaffected6.18.58 to ≤ 6.18.*unaffected7.2.11 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/b14a682ad7d45345701e08f9279d483a1da8b36c ↗
- https://git.kernel.org/stable/c/f5b143f4cd3fb7673df8d727550478a4b762908a ↗
- https://git.kernel.org/stable/c/2d06cb25a497d3a7034ef9d172626c2d6620a0f1 ↗
- https://git.kernel.org/stable/c/8f27260b989f488760289276377db24fbfb20bfa ↗
- https://git.kernel.org/stable/c/8bc60db48e8cba35488bbd6e1f94aa990afa275a ↗