Executive Summary

This vulnerability exists in the Linux kernel's network scheduler component, specifically in the act_mirred module within the tcf_blockcast_redir() function.

When redirecting packets to multiple devices, the code incorrectly queries the mac_header_xmit flag from the wrong device in the iteration loop. It checks the flag on the next device instead of the current device being sent to.

This mistake causes incorrect decisions about whether to push or pull the MAC header on packets, which can lead to corruption of the socket buffer (skb) header when the block contains mixed device types like ethernet veth and tunnel devices.

In the worst case, this can exhaust the packet's headroom and cause a kernel panic.

The fix involves querying the mac_header_xmit flag from the correct device (dev_prev) consistent with the device actually being sent to.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause corruption of network packet headers when packets are redirected across multiple network devices of different types.

Such corruption may lead to network communication errors or instability in the Linux kernel's networking stack.

In the worst case, it can cause the kernel to panic, resulting in system crashes and potential downtime.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability is fixed by correcting the device used for the mac_header_xmit check in the Linux kernel's net/sched act_mirred module. To mitigate this vulnerability immediately, you should update your Linux kernel to a version that includes this fix.

• Identify your current Linux kernel version.
• Check for available kernel updates from your distribution that address this issue.
• Apply the kernel update and reboot the system to load the patched kernel.

Until the update is applied, avoid configurations that mix device types (e.g., ethernet veth and tunnel devices) in block ports that use tcf_blockcast_redir, as this can trigger the vulnerability.

Useful 0 Not Useful 0