Executive Summary

This vulnerability exists in the Linux kernel's netfilter logging component (nf_log). It occurs because the code attempts to dump the MAC header without properly verifying if the MAC header was set. Specifically, the fallback path in dump_mac_header() only checks if the MAC header pointer differs from the network header pointer, but does not confirm if the MAC header was actually set.

When the MAC header is unset, its value is 0xffff, which causes the check to pass incorrectly. As a result, the function reads memory about 64 KiB past the intended buffer boundary, leading to an out-of-bounds read. This happens when packets are sent through AF_PACKET with PACKET_QDISC_BYPASS, bypassing the usual reset of the MAC header.

The issue was fixed by adding a proper check to ensure the MAC header was set before accessing it, preventing the out-of-bounds read.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause the Linux kernel to read memory out of bounds when logging network packets, which may lead to kernel crashes or instability due to memory corruption.

An attacker could potentially exploit this flaw to cause denial of service (DoS) by triggering kernel crashes through specially crafted network packets.

While the description does not explicitly mention privilege escalation or code execution, out-of-bounds reads in kernel space can sometimes be leveraged for further attacks depending on the system context.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves out-of-bounds reads in the Linux kernel's netfilter logging code when the MAC header is unset. Detection would typically involve monitoring kernel logs for related error messages such as KASAN slab-out-of-bounds reports referencing dump_mac_header or nf_log_syslog.c.

Since the issue occurs during packet logging via netdev logger and AF_PACKET sockets with PACKET_QDISC_BYPASS, you can check for suspicious packets or attempts to send packets through AF_PACKET sockets with this flag set.

However, no specific commands or detection tools are provided in the available information.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability has been resolved by adding a check to ensure the MAC header was set before accessing it in the kernel logging code. Immediate mitigation steps would include updating the Linux kernel to a version that includes this fix.

Until the kernel is updated, consider restricting or monitoring the use of AF_PACKET sockets with PACKET_QDISC_BYPASS to reduce the risk of triggering the vulnerability.

No other specific mitigation commands or workarounds are provided in the available information.

Useful 0 Not Useful 0