| From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001 |
| From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| To: <linux-cve-announce@vger.kernel.org> |
| Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> |
| Subject: CVE-2021-47309: net: validate lwtstate->data before returning from skb_tunnel_info() |
| |
| Description |
| =========== |
| |
| In the Linux kernel, the following vulnerability has been resolved: |
| |
| net: validate lwtstate->data before returning from skb_tunnel_info() |
| |
| skb_tunnel_info() returns pointer of lwtstate->data as ip_tunnel_info |
| type without validation. lwtstate->data can have various types such as |
| mpls_iptunnel_encap, etc and these are not compatible. |
| So skb_tunnel_info() should validate before returning that pointer. |
| |
| Splat looks like: |
| BUG: KASAN: slab-out-of-bounds in vxlan_get_route+0x418/0x4b0 [vxlan] |
| Read of size 2 at addr ffff888106ec2698 by task ping/811 |
| |
| CPU: 1 PID: 811 Comm: ping Not tainted 5.13.0+ #1195 |
| Call Trace: |
| dump_stack_lvl+0x56/0x7b |
| print_address_description.constprop.8.cold.13+0x13/0x2ee |
| ? vxlan_get_route+0x418/0x4b0 [vxlan] |
| ? vxlan_get_route+0x418/0x4b0 [vxlan] |
| kasan_report.cold.14+0x83/0xdf |
| ? vxlan_get_route+0x418/0x4b0 [vxlan] |
| vxlan_get_route+0x418/0x4b0 [vxlan] |
| [ ... ] |
| vxlan_xmit_one+0x148b/0x32b0 [vxlan] |
| [ ... ] |
| vxlan_xmit+0x25c5/0x4780 [vxlan] |
| [ ... ] |
| dev_hard_start_xmit+0x1ae/0x6e0 |
| __dev_queue_xmit+0x1f39/0x31a0 |
| [ ... ] |
| neigh_xmit+0x2f9/0x940 |
| mpls_xmit+0x911/0x1600 [mpls_iptunnel] |
| lwtunnel_xmit+0x18f/0x450 |
| ip_finish_output2+0x867/0x2040 |
| [ ... ] |
| |
| The Linux kernel CVE team has assigned CVE-2021-47309 to this issue. |
| |
| |
| Affected and fixed versions |
| =========================== |
| |
| Issue introduced in 4.3 with commit 61adedf3e3f1d3f032c5a6a299978d91eff6d555 and fixed in 4.4.277 with commit e7f3c9df40515a6c6b46f36c4c94cf48a043f887 |
| Issue introduced in 4.3 with commit 61adedf3e3f1d3f032c5a6a299978d91eff6d555 and fixed in 4.9.277 with commit b61d327cd3cc5ea591f3bf751dd11e034f388bb5 |
| Issue introduced in 4.3 with commit 61adedf3e3f1d3f032c5a6a299978d91eff6d555 and fixed in 4.14.241 with commit 83bdcfbd968bcc91a0632b7b625e4a9b0cba5e0d |
| Issue introduced in 4.3 with commit 61adedf3e3f1d3f032c5a6a299978d91eff6d555 and fixed in 4.19.199 with commit 8bb1589c89e61e3b182dd546f1021928ebb5c2a6 |
| Issue introduced in 4.3 with commit 61adedf3e3f1d3f032c5a6a299978d91eff6d555 and fixed in 5.4.135 with commit 8aa13a86964cdec4fd969ef677c6614ff068641a |
| Issue introduced in 4.3 with commit 61adedf3e3f1d3f032c5a6a299978d91eff6d555 and fixed in 5.10.53 with commit 2179d96ec702cc33ead02a9ce40ece599b8538c5 |
| Issue introduced in 4.3 with commit 61adedf3e3f1d3f032c5a6a299978d91eff6d555 and fixed in 5.13.5 with commit a915379594f1e045421635c6316d8f3ffa018c58 |
| Issue introduced in 4.3 with commit 61adedf3e3f1d3f032c5a6a299978d91eff6d555 and fixed in 5.14 with commit 67a9c94317402b826fc3db32afc8f39336803d97 |
| |
| Please see https://www.kernel.org for a full list of currently supported |
| kernel versions by the kernel community. |
| |
| Unaffected versions might change over time as fixes are backported to |
| older supported kernel versions. The official CVE entry at |
| https://cve.org/CVERecord/?id=CVE-2021-47309 |
| will be updated if fixes are backported, please check that for the most |
| up to date information about this issue. |
| |
| |
| Affected files |
| ============== |
| |
| The file(s) affected by this issue are: |
| include/net/dst_metadata.h |
| |
| |
| Mitigation |
| ========== |
| |
| The Linux kernel CVE team recommends that you update to the latest |
| stable kernel version for this, and many other bugfixes. Individual |
| changes are never tested alone, but rather are part of a larger kernel |
| release. Cherry-picking individual commits is not recommended or |
| supported by the Linux kernel community at all. If however, updating to |
| the latest release is impossible, the individual changes to resolve this |
| issue can be found at these commits: |
| https://git.kernel.org/stable/c/e7f3c9df40515a6c6b46f36c4c94cf48a043f887 |
| https://git.kernel.org/stable/c/b61d327cd3cc5ea591f3bf751dd11e034f388bb5 |
| https://git.kernel.org/stable/c/83bdcfbd968bcc91a0632b7b625e4a9b0cba5e0d |
| https://git.kernel.org/stable/c/8bb1589c89e61e3b182dd546f1021928ebb5c2a6 |
| https://git.kernel.org/stable/c/8aa13a86964cdec4fd969ef677c6614ff068641a |
| https://git.kernel.org/stable/c/2179d96ec702cc33ead02a9ce40ece599b8538c5 |
| https://git.kernel.org/stable/c/a915379594f1e045421635c6316d8f3ffa018c58 |
| https://git.kernel.org/stable/c/67a9c94317402b826fc3db32afc8f39336803d97 |
