Vulnerability in Kernel: veth skb Cloning
Summary
GSD-2021-1002826: veth: ensure skb entering GRO are not cloned. Affects Kernel versions >= d3256efd8e8b234a6251e4d4580bd2c3c31fdc4c, < d2269ae48598e05b59ec9ea9e6e44fd33941130d. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a critical component of the Linux operating system that provides essential services and functions for the system's operation. It manages hardware resources, facilitates communication between software and hardware, and provides various system services. The veth (Virtual Ethernet) module is responsible for creating virtual network interfaces that can be used for network communication between different processes or containers. However, a vulnerability has been discovered in the veth module that allows skb (socket buffer) packets entering the Generic Receive Offload (GRO) process to be cloned, potentially leading to security issues.
Vulnerability Detail
The vulnerability in the veth module allows skb packets entering the GRO process to be cloned. This can result in multiple instances of the same packet being processed, potentially leading to security issues such as packet duplication, data corruption, or unauthorized access. The vulnerability was introduced in Linux Kernel version 5.13 and has been fixed in version 5.15.12 by commit d2269ae48598e05b59ec9ea9e6e44fd33941130d.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can disable the GRO feature for the veth module. This can be achieved by executing the following command as root:
echo 0 > /sys/module/veth/parameters/gro_enabled
However, disabling GRO may impact network performance, and it is recommended to apply the official fix as soon as possible.
Conclusion
The vulnerability in the veth module of the Kernel can lead to security issues by allowing skb packets entering the GRO process to be cloned. It is crucial to update the Linux Kernel to version 5.15.12 or later to fix this vulnerability. As a temporary workaround, users can disable the GRO feature, but it is recommended to apply the official fix as soon as possible. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability allows skb packets entering the GRO process to be cloned, which can lead to security issues such as packet duplication, data corruption, or unauthorized access.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file, and Vulert will analyze it for any open-source vulnerabilities, including this one.
At the time of this report, there is no known exploit for this vulnerability. However, it is important to apply the fix as soon as possible to mitigate any potential risks.
As a temporary workaround, you can disable the GRO feature for the veth module. However, this may impact network performance, and it is recommended to apply the official fix by updating the Kernel.
You can find more information about this vulnerability, including the fix and its impact, in the official Linux Kernel repository (https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/).
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
