Executive Summary

This vulnerability exists in the Linux kernel's handling of IPv6 tunneling with SIT (Simple Internet Transition). Specifically, the function ipip6_tunnel_xmit() caches a pointer to the inner IPv6 header at the start and continues to use it after offload processing by iptunnel_handle_offloads().

For Generic Segmentation Offload (GSO) socket buffers (skbs), iptunnel_handle_offloads() calls skb_header_unclone(), which may invoke pskb_expand_head(). This function can move the skb header, requiring pointers into the skb header to be reloaded afterward.

If the skb_realloc_headroom() branch is not taken, SIT uses a stale pointer to the inner IPv6 header to read fields like the hop limit and DS field. This stale pointer can reference a freed skb head after the last clone of the old head is released, leading to use-after-free conditions.

The fix involves reloading the inner IPv6 header pointer after the offload helper succeeds and before any subsequent reads, ensuring that the pointer is always valid.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to the Linux kernel accessing freed memory due to stale pointers when processing IPv6 tunneled packets with GSO offloads.

Such use-after-free conditions can cause kernel crashes, instability, or potentially allow attackers to execute arbitrary code or cause denial of service by exploiting the memory corruption.

Useful 0 Not Useful 0