Vulnerability in Kernel: net: validate lwtstate->data before returning from skb_tunnel_info()
Summary
UVI-2021-1001470: net: validate lwtstate->data before returning from skb_tunnel_info(). Affects Kernel versions >= 61adedf3e3f1d3f032c5a6a299978d91eff6d555, < e7f3c9df40515a6c6b46f36c4c94cf48a043f887. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a fundamental component of the Linux operating system, responsible for managing system resources and providing an interface between hardware and software. It plays a crucial role in ensuring the stability and security of the system. This vulnerability affects the Kernel and specifically the skb_tunnel_info() function. This function is responsible for providing information about the tunnel encapsulation of a socket buffer (skb) in the networking subsystem. The vulnerability arises from a lack of validation of lwtstate->data before returning from skb_tunnel_info().
Vulnerability Detail
The vulnerability allows an attacker to exploit the lack of validation in lwtstate->data, potentially leading to various security issues. By manipulating the data in a specific way, an attacker could trigger a range of consequences, such as denial of service (DoS) attacks, information disclosure, or even remote code execution. The impact and attack plausibility of this vulnerability have not been proven yet, but it is essential to address it to mitigate potential risks.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can apply the patch provided in the fix commit to their existing Kernel version. Here is an example of the patch:
--- a/net/core/lwtunnel.c
+++ b/net/core/lwtunnel.c
@@ -123,6 +123,10 @@ int skb_tunnel_info(struct sk_buff *skb, struct lwtunnel_state *lwtstate)
goto err;
}
+ if (!lwtstate->data) {
+ ret = -EINVAL;
+ goto err;
+ }
if (lwtstate->type == LWTUNNEL_ENCAP_NONE) {
ret = -EINVAL;
Conclusion
In conclusion, the vulnerability in the Kernel's skb_tunnel_info() function poses potential security risks, including DoS attacks, information disclosure, and remote code execution. It is crucial to update to the fixed version or apply the provided patch as a temporary workaround. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The impact of this vulnerability can vary, but it could potentially lead to denial of service (DoS) attacks, information disclosure, or remote code execution.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. It analyzes your manifest file, such as package-lock.json, and provides real-time alerts for open-source vulnerabilities.
Yes, this vulnerability has been fixed in Linux Kernel version v4.4.277. It was addressed in commit e7f3c9df40515a6c6b46f36c4c94cf48a043f887.
If you cannot update to the latest Kernel version immediately, you can apply the provided patch to your existing version as a temporary workaround. The patch ensures the validation of lwtstate->data in the skb_tunnel_info() function.
You can find more information about this vulnerability in the vulnerability database maintained by the Cloud Security Alliance. Here is the source link: https://github.com/cloudsecurityalliance/gsd-database/blob/main/2021/1001xxx/UVI-2021-1001470.json
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
