Executive Summary

This vulnerability is a use-after-free issue in the Linux kernel's ovpn_net_xmit function. When building the skb_list, the function skb_share_check may free the original skb if it is shared, but the code continues to use the freed (stale) skb pointer for further operations such as peer lookup, skb_dst_drop, and ovpn_peer_stats_increment_tx. This improper use of a freed pointer can lead to undefined behavior or crashes.

The fix involves reordering operations so that peer lookup and skb_dst_drop occur before segmentation, ensuring the original skb is still valid when used. Additionally, the code returns early if all segments fail skb_share_check, preventing use of an empty list, and adjusts stats logic to use the next skb in the list.

Useful 0 Not Useful 0

Impact Analysis

This use-after-free vulnerability can cause the Linux kernel to behave unpredictably, potentially leading to system crashes, memory corruption, or security issues such as privilege escalation or denial of service. Since it involves network packet processing in the ovpn module, it could affect systems using OpenVPN or similar VPN implementations relying on this kernel code.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, update the Linux kernel to a version where the ovpn_net_xmit use-after-free issue has been fixed. The fix involves changes to the ovpn_net_xmit function to avoid using a stale skb pointer after skb_share_check frees the original skb.

Specifically, ensure your kernel includes the patch that moves the peer lookup and skb_dst_drop operations before segmentation, and that it returns early if all segments fail skb_share_check. This prevents use-after-free conditions in the ovpn module.

Useful 0 Not Useful 0