SLIP Packet Length Bounds Read in Linux Kernel

Executive Summary

This vulnerability exists in the Linux kernel's slip protocol implementation, specifically in the slipc_uncompress() function that parses VJ-compressed TCP headers. The decode() function reads data from compressed packets without proper bounds checking against the packet length, allowing it to read past the end of a short compressed frame. This causes an over-read of bytes which are then incorrectly folded into the cached connection state and reflected in subsequent reconstructed packets.

The root cause is that decode() masks its return value so it never returns -1, which callers expect to detect errors, making those error paths ineffective. The fix involves making decode() and pull16() functions take the packet end pointer and return -1 when they reach the end, enabling proper bounds checking and error handling.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to the Linux kernel reading beyond the intended bounds of compressed network packets, potentially causing corrupted reconstructed TCP packets. This could result in network communication errors or unexpected behavior in applications relying on these packets.

Because the over-read bytes are folded into the cached connection state and reflected in subsequent packets, it may cause data integrity issues or unpredictable network traffic handling, which could be exploited or cause denial of service in some scenarios.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability has been resolved in the Linux kernel by modifying the decode() and pull16() functions to properly check packet boundaries and return -1 when exhausted, preventing out-of-bounds reads.

Therefore, the immediate step to mitigate this vulnerability is to update your Linux kernel to a version that includes this fix.

Useful 0 Not Useful 0