Executive Summary

This vulnerability exists in the Linux kernel's tun driver, specifically in the function tun_put_user(). The function declares a struct virtio_net_hdr_v1_hash_tunnel on the stack but does not zero out the entire structure. For non-tunnel packets, only the first 10 bytes of this structure are initialized, leaving the remaining bytes as uninitialized stack memory.

An unprivileged user can exploit this by setting the virtual network header size to 24 bytes using the TUNSETVNETHDRSZ ioctl. When the kernel copies this partially initialized structure to userspace, it leaks 14 bytes of kernel stack memory on every read of a non-tunnel packet. This leakage occurs because __tun_vnet_hdr_put() copies all 24 bytes, including the uninitialized parts.

The vulnerability was fixed by zeroing the entire vnet header structure immediately after its declaration, preventing any uninitialized kernel stack data from being leaked.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to information disclosure by leaking kernel stack memory to unprivileged users. The leaked data may contain sensitive information from the kernel's memory space, which could be used to aid further attacks such as privilege escalation or bypassing security mechanisms.

Since the leak occurs on every read of a non-tunnel packet when the vnet header size is set to 24, an attacker can repeatedly exploit this to gather significant amounts of kernel memory data.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability is fixed by zeroing the whole vnet header in the tun_put_user() function, similar to the existing fix in tun_get_user().

To mitigate this vulnerability immediately, you should update your Linux kernel to a version that includes this fix.

This prevents unprivileged users from leaking kernel stack data via the TUNSETVNETHDRSZ ioctl.

Useful 0 Not Useful 0