Executive Summary

This vulnerability exists in the Linux kernel's MPLS (Multiprotocol Label Switching) implementation. Specifically, the codepaths protected by RCU (Read-Copy-Update), such as mpls_forward and mpls_dump_routes, can have an inconsistent view of platform_labels versus platform_label during a concurrent resize operation of the platform_label_table. This inconsistency can lead to out-of-bounds (OOB) memory accesses.

The issue arises because the resize operation is protected by a mutex (platform_mutex), but the RCU-protected codepaths do not have a consistent snapshot of the data during this resize. To fix this, a sequence counter (seqcount) was added to ensure a consistent snapshot is obtained, preventing OOB accesses.

Additionally, the function mpls_label_ok is also susceptible to this inconsistency, so certain checks outside the mutex are not sufficient on their own. The patch ensures these checks remain intact to avoid issues.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to out-of-bounds memory accesses in the Linux kernel's MPLS code. Such memory errors can cause system instability, crashes, or potentially allow an attacker to execute arbitrary code or cause denial of service.

Because the issue involves concurrent access and resizing of kernel data structures, it could be exploited to compromise system reliability or security, especially on systems using MPLS features.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability in the Linux kernel related to inconsistent views of platform_labels during concurrent resize operations has been resolved by adding a seqcount to ensure consistent snapshots.

To mitigate this vulnerability immediately, you should update your Linux kernel to a version that includes this patch which protects the platform_label pairs with seqcount.

Useful 0 Not Useful 0