Executive Summary

This vulnerability exists in the Linux kernel's tun driver, specifically in the function tun_xdp_one(). When a frame shorter than the Ethernet header length (ETH_HLEN) is processed, tun_xdp_one() returns an error (-EINVAL) but fails to free the memory page allocated for that frame. Because tun_sendmsg() ignores this error and returns the total length as if successful, the higher-level function vhost_tx_batch() assumes success and does not free the allocated page. This results in a memory leak of page-frag chunks for each short frame processed.

A local process with access to /dev/net/tun and /dev/vhost-net can exploit this by attaching a tun/tap device as the vhost-net backend and sending TX descriptors with lengths shorter than ETH_HLEN. Repeatedly doing this in a tight loop causes continuous memory leaks, eventually exhausting host memory and causing an out-of-memory (OOM) panic.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to a denial of service (DoS) condition on the affected system. By exploiting the memory leak, an attacker with local access can cause the system to run out of memory, triggering an out-of-memory (OOM) panic. This can disrupt normal operations, potentially causing system crashes or instability.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, ensure that your Linux kernel is updated to a version where the issue in tun_xdp_one() has been fixed. The fix involves freeing the page before returning -EINVAL on short frames, preventing memory leaks.

Additionally, restrict local processes from opening /dev/net/tun and /dev/vhost-net unless necessary, as exploitation requires access to these devices.

Useful 0 Not Useful 0