Executive Summary

This vulnerability exists in the Linux kernel's handling of IPv6 tunnels, specifically in the ip4ip6_err() function. The issue arises because ip4ip6_err() calls icmp_send() on a cloned socket buffer (skb) whose control buffer (cb[]) was previously written by the IPv6 receive path as a structure (inet6_skb_parm). However, icmp_send() treats this cb[] region as a different structure (inet_skb_parm) used for IPv4, which have different layouts.

Due to this mismatch, a field overlap causes a non-zero value to be read incorrectly, leading __ip_options_echo() to read an attacker-controlled length from the packet data and copy that many bytes into a fixed 40-byte stack buffer. This can cause a buffer overflow or memory corruption.

The fix involved clearing the skb2->cb[] buffer before use and adding minimal IPv4 header validation to prevent malformed packets from triggering this behavior.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to memory corruption in the Linux kernel due to improper handling of packet data in IPv6 tunnels. An attacker could exploit this flaw by sending specially crafted packets that trigger a buffer overflow in the kernel stack.

Potential impacts include system instability, crashes (kernel panics), or possibly arbitrary code execution with kernel privileges, which could compromise the entire system's security.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability is resolved by clearing the skb2->cb[] buffer in the ip4ip6_err() function and adding minimal IPv4 header validation (version == 4, ihl >= 5).

To mitigate this vulnerability immediately, you should update your Linux kernel to a version that includes this fix.

Useful 0 Not Useful 0