macvlan: Fix leaking skb in source mode with nodst option
Summary
GSD-2022-1000978: macvlan: Fix leaking skb in source mode with nodst option. Affects Kernel versions >= 427f0c8c194b22edcafef1b0a42995ddc5c2227d, < f382df5ff36bc9fa10e0f898f3051d0702085304. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The macvlan package is a part of the Linux Kernel ecosystem. It provides a virtual network interface that can be used to create multiple virtual interfaces on a single physical interface. These virtual interfaces can be configured to operate in different modes, such as bridge mode or source mode. In source mode, the macvlan package allows packets to be sent out from the virtual interface without a destination MAC address. However, a vulnerability has been discovered in the source mode with the nodst option, which can lead to a leaking skb (socket buffer) issue.
Vulnerability Detail
The vulnerability in macvlan's source mode with the nodst option allows for the leaking of skb, which can have potential security implications. When this option is enabled, packets sent from the virtual interface do not have a destination MAC address. However, due to a flaw in the implementation, the skb is not properly handled and can be leaked. An attacker could potentially exploit this vulnerability to gain unauthorized access or perform other malicious activities. The vulnerability was introduced in Linux Kernel version v5.13 and has been fixed in version v5.17.4.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If updating the Linux Kernel is not immediately feasible, a possible workaround is to disable the nodst option in macvlan's source mode. This can be done by modifying the configuration of the virtual interface to use a destination MAC address for outgoing packets. However, it is important to note that this workaround may impact the intended functionality of the macvlan package.
Conclusion
In conclusion, the macvlan package in the Linux Kernel ecosystem is vulnerable to a leaking skb issue in source mode with the nodst option. This vulnerability can be mitigated by updating the Linux Kernel to version v5.17.4 or later. If immediate kernel update is not possible, disabling the nodst option can serve as a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
macvlan is a virtual network interface package in the Linux Kernel ecosystem that allows for the creation of multiple virtual interfaces on a single physical interface.
The source mode in macvlan allows packets to be sent out from the virtual interface without a destination MAC address.
The nodst option in macvlan's source mode disables the inclusion of a destination MAC address in outgoing packets.
The leaking skb vulnerability in macvlan's source mode with the nodst option can potentially be exploited by attackers to gain unauthorized access or perform other malicious activities.
The vulnerability can be fixed by updating the Linux Kernel to version v5.17.4 or later.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
