In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ip6_tunnel: use skb_cow_head() in ip6_tnl_xmit()<\/p>\n
ip6_tnl_xmit() may need to expand headroom before it can push the
\nouter IPv6 and optional encap headers. It currently does that with
\nskb_realloc_headroom(), copies skb->sk ownership, consumes the original
\nskb, and then continues processing with the replacement skb kept only in
\nits local variable.<\/p>\n
That is safe only if the helper cannot fail afterwards. But this helper
\nstill has post-reallocation error exits. collect_md tunnels reject
\nnon-NONE encap after the replacement, and ip6_tnl_encap() can also fail
\nlater. In those cases the helper returns an error to its callers while
\nthe caller still only has the original skb pointer.<\/p>\n
Both ip6_tnl_start_xmit() and the IPv6 GRE paths free the caller skb on
\nerror, so they can end up freeing an skb that ip6_tnl_xmit() already
\nconsumed.<\/p>\n
Use skb_cow_head() instead. It provides the required headroom and
\nwritability without privately replacing the caller-owned skb, so later
\nerror returns cannot leave callers with a stale pointer.<\/p>\n
The Ethernet users, ip6gretap and ip6erspan, clear IFF_TX_SKB_SHARING
\nand already call skb_cow_head() before entering ip6_tnl_xmit(). They do
\nnot rely on the removed skb_shared() reallocation. This also makes the
\nIPv6 tunnel path consistent with ip_tunnel_xmit().<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ip6_tunnel: use skb_cow_head() in ip6_tnl_xmit()<\/p>\n
ip6_tnl_xmit() may need to expand headroom before it can push the
\nouter IPv6 and <\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-21485","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/21485","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=21485"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=21485"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=21485"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}