In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ipip: fix skb leak in collect_md mode when metadata_dst allocation fails<\/p>\n
In collect_md mode ipip_tunnel_rcv() returns 0 without freeing the skb
\nwhen ip_tun_rx_dst() fails to allocate the metadata_dst. ipip_rcv() and
\nmplsip_rcv() are registered as xfrm_tunnel handlers, so tunnel4_rcv()
\nand tunnelmpls4_rcv() read the zero return as “the packet has been
\nconsumed” and do not free it either. The skb is leaked.<\/p>\n
The other tunnel drivers all dispose of the packet at this point:
\nip6_tunnel.c jumps to its drop label, ip_gre.c and ip6_gre.c return
\nPACKET_REJECT, which makes gre_rcv() free the skb. Only ipip returns 0.<\/p>\n
Jump to the existing drop label instead. It frees the skb and still
\nreturns 0, so the packet keeps being reported as consumed, which is what
\nwe want here: the outer header has already been pulled, and neither the
\nremaining handlers nor an ICMP unreachable have any use for it.<\/p>\n
Triggering this needs an ipip or mplsip tunnel in collect_md mode and an
\natomic allocation failure, which is why it has gone unnoticed.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ipip: fix skb leak in collect_md mode when metadata_dst allocation fails<\/p>\n
In collect_md mode ipip_tunnel_rcv() returns 0 without fr<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-21487","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/21487","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=21487"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=21487"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=21487"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}