net/sched: act_skbmod: Skip non-Ethernet packets
Summary
GSD-2021-1001309: net/sched: act_skbmod: Skip non-Ethernet packets. Affects Kernel versions >= 86da71b57383d40993cb90baafb3735cffe5d800, < a88414fb1117f2fe65fb88e45ba694e1d09d5024. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux Kernel is a widely used open-source operating system kernel that serves as the foundation for various Linux distributions. It provides essential functionality for managing system resources and facilitating communication between hardware and software components. The net/sched module within the kernel is responsible for implementing network traffic control and shaping mechanisms. One of the actions supported by this module is act_skbmod, which allows modification of packet metadata. However, a vulnerability has been identified in the act_skbmod action that allows non-Ethernet packets to bypass the intended processing flow.
Vulnerability Detail
The vulnerability in the act_skbmod action of the net/sched module allows non-Ethernet packets to be processed incorrectly. This can lead to unexpected behavior and potential security risks. Non-Ethernet packets should be skipped to ensure proper handling, but the vulnerability allows them to proceed through the processing flow. The impact and attack plausibility of this vulnerability have not been proven yet. It is fixed in Linux Kernel version v5.4.136 by commit a88414fb1117f2fe65fb88e45ba694e1d09d5024. The vulnerability was introduced in version v4.9 by commit 86da71b57383d40993cb90baafb3735cffe5d800.
How To Fix
No fixed version is published for this vulnerability.
To fix this vulnerability, it is recommended to update the Linux Kernel to version v5.4.136 or later. This can be done by obtaining the updated kernel source code from the official Linux Kernel repository and compiling it for the target system. Alternatively, users can wait for their Linux distribution to provide an updated package containing the fixed kernel version.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can apply a patch that addresses the vulnerability. Here is an example patch for the affected code:
--- a/net/sched/act_skbmod.c
+++ b/net/sched/act_skbmod.c
@@ -123,6 +123,8 @@ static int tcf_skbmod_act(struct sk_buff *skb, const struct tc_action *a,
struct tcf_skbmod *d = to_skbmod(a);
struct ethhdr *eth;
+ if (!skb->protocol || !eth_proto_is_802_3(skb->protocol))
+ return TC_ACT_OK;
eth = eth_hdr(skb);
return skbmod_modify(skb, d, eth);
Conclusion
The vulnerability in the act_skbmod action of the net/sched module in the Linux Kernel allows non-Ethernet packets to bypass the intended processing flow. This can have unexpected consequences and potential security implications. It is crucial to apply the provided fix or workaround to mitigate any potential risks. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The net/sched module in the Linux Kernel is responsible for implementing network traffic control and shaping mechanisms. It allows for the manipulation and modification of network packets to enforce quality of service policies and prioritize traffic.
The act_skbmod action is a component of the net/sched module that allows for the modification of packet metadata. It can be used to alter packet headers, mark packets, or perform other packet-level operations.
The vulnerability in act_skbmod allows non-Ethernet packets to bypass the intended processing flow. This can lead to unexpected behavior and potential security risks. Attackers may be able to exploit this vulnerability to manipulate network traffic and potentially compromise the system.
No, the impact and attack plausibility of this vulnerability have not been proven yet. However, it is important to apply the fix or workaround to mitigate any potential risks.
To fix this vulnerability, it is recommended to update the Linux Kernel to version v5.4.136 or later. This can be done by obtaining the updated kernel source code from the official Linux Kernel repository and compiling it for the target system. Alternatively, users can wait for their Linux distribution to provide an updated package containing the fixed kernel version.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.