seg6: Fix skb checksum in SRv6 End.B6 and End.B6.Encaps behaviors in Kernel
Summary
GSD-2022-1004567: seg6: fix skb checksum in SRv6 End.B6 and End.B6.Encaps behaviors. Affects Kernel versions >= 140f04c33bbcf89440dcaf8bef04918abff5a52d, < 7b38df59a8f4119e1c9d83922f28c67fac9291d8. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a crucial component of the Linux operating system that provides core functionalities and acts as an interface between hardware and software. It manages system resources, facilitates communication between different software components, and ensures the overall stability and security of the system. The vulnerability in question affects the Kernel's implementation of the seg6 module, specifically the SRv6 End.B6 and End.B6.Encaps behaviors.
Vulnerability Detail
The vulnerability arises from an issue with the skb (socket buffer) checksum in the SRv6 End.B6 and End.B6.Encaps behaviors of the seg6 module. This vulnerability could potentially be exploited by an attacker to manipulate or bypass the checksum verification process, leading to various security risks. The exact impact and attack plausibility of this vulnerability have not been proven yet.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
In conclusion, the seg6 module in the Linux Kernel is vulnerable to an skb checksum issue in the SRv6 End.B6 and End.B6.Encaps behaviors. To mitigate this vulnerability, it is recommended to update the Kernel to version v5.10.132 or later. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The seg6 module in the Kernel is responsible for implementing Segment Routing IPv6 (SRv6) functionality. It enables the creation of IPv6 segments and the definition of explicit paths for packets to traverse.
SRv6 End.B6 and End.B6.Encaps are specific behaviors within the seg6 module. End.B6 behavior represents the endpoint of an SRv6 path with an IPv6 destination address. End.B6.Encaps behavior encapsulates packets with an IPv6 header and SRH (Segment Routing Header) for SRv6 forwarding.
The skb checksum issue in the SRv6 End.B6 and End.B6.Encaps behaviors could potentially allow an attacker to manipulate or bypass the checksum verification process. This could lead to various security risks, such as data integrity violations or the injection of malicious packets into the network.
No, the exact impact and attack plausibility of this vulnerability have not been proven yet. However, it is still recommended to apply the fix provided by updating the Kernel to the latest version.
You can find more information about this vulnerability in the GSD-2022-1004567 entry of the GSD database maintained by the Cloud Security Alliance. The source link is available in the database-specific section of the vulnerability details.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
