Vulnerability in Linux Kernel: gso: do not skip outer ip header in case of ipip and net_failover
Summary
GSD-2022-1000933: gso: do not skip outer ip header in case of ipip and net_failover. Affects Kernel versions >= cb32f511a70be8967ac9025cf49c44324ced9a39, < 7840e559799a08a8588ee6de27516a991cb2e5e7. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux Kernel is a critical component of the Linux operating system, responsible for managing the system's core functionality. It provides essential services such as process management, memory management, and device drivers. The vulnerability in question affects the handling of outer IP headers in the case of IP over IP (IPIP) and network failover (net_failover) configurations.
Vulnerability Detail
The vulnerability arises from a flaw in the gso (generic segmentation offload) implementation within the Linux Kernel. In certain scenarios involving IPIP and net_failover, the outer IP header is erroneously skipped, leading to potential security issues. Although the exact impact and attack vectors have not been proven, this vulnerability could potentially be exploited to bypass security measures or cause network disruptions.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can disable the affected configurations involving IPIP and net_failover until the Linux Kernel is updated. This can be achieved by modifying the network configuration to avoid using these configurations. However, it is important to note that this workaround may impact network functionality and should only be considered as a temporary measure.
Conclusion
The vulnerability in the Linux Kernel's gso implementation can potentially lead to security issues in scenarios involving IPIP and net_failover. It is crucial to update the Linux Kernel to version v4.14.269 or later to mitigate this vulnerability. Users can obtain the updated kernel from the official Linux Kernel repository. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The Linux Kernel is a critical component of the Linux operating system, responsible for managing the system's core functionality.
gso is a feature in the Linux Kernel that offloads the segmentation of large network packets to the network interface hardware, improving network performance.
IP over IP (IPIP) is a tunneling protocol that encapsulates IP packets within IP packets, allowing them to be transmitted over an IP network.
Network failover is a mechanism that automatically switches network traffic to a backup network connection in case of a primary connection failure.
To update the Linux Kernel, users can obtain the latest version from the official Linux Kernel repository and follow the installation instructions provided.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
