In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net: extend IPv6 exthdr detection of tunneled packets<\/p>\n
Commit c4336a07eb6b (“net: correctly handle tunneled traffic on IPV6_CSUM
\nGSO fallback”) split skb_gso_has_extension_hdr() into mutually exclusive
\nbranches on skb->encapsulation. This did not yet address all paths:<\/p>\n
1. With skb->encapsulation set, the outer header is not checked. IPv6
\n tunnels such as ip6_gre and ip6_tunnel add an outer Destination
\n Options header by default (encap_limit). Their GSO packets skip
\n software GSO, then skb_csum_hwoffload_help() sees the outer extension
\n header and calls skb_checksum_help() on the GSO skb, which warns and
\n drops it.<\/p>\n
2. Tunnels over IPv6 without an outer transport header, such as
\n ip6_tunnel, leave skb->transport_header at the inner transport
\n header. skb_network_header_len() then spans the outer IPv6, tunnel
\n and inner IP headers, a false positive.<\/p>\n
3. UDP tunnels without an inner network header, such as SCTP-in-UDP or
\n PSP, have no inner IPv6 header to check. Decide on the outer header
\n alone.<\/p>\n
4. Directly dereferencing inner_ip_hdr(skb)->version without
\n skb_header_pointer() is unsafe.<\/p>\n
Instead, check ipv6_ext_hdr(nexthdr) on the outer IPv6 header and, if
\nset, on the inner IPv6 header. Read the headers with skb_header_pointer().
\nKeep the skb_network_header_len() check when !skb->encapsulation to also
\ncatch encapsulated packets without skb->encapsulation (e.g., virtio).<\/p>\n
Use the same helper in skb_csum_hwoffload_help(). Its open coded test
\nhas the false positive of (2) and ignores the inner header.<\/p>\n
Background: checksum offload of tunneled packets invariants:<\/p>\n
Non-GSO skb:
\n– If the inner packet is CHECKSUM_PARTIAL, Local Checksum Offload computes
\n the outer checksum in software and the device offloads only the inner L4
\n checksum.
\n– If the inner packet is CHECKSUM_NONE (e.g., SCTP-in-UDP, ESP-in-UDP,
\n Remote Checksum Offload), the device offloads the outer UDP or GRE
\n checksum instead.<\/p>\n
GSO skb:
\n– A device with NETIF_F_GSO_UDP_TUNNEL_CSUM or NETIF_F_GSO_GRE_CSUM
\n computes both inner and outer checksums per segment.
\n The outer checksum is seeded with only the pseudo-header checksum.<\/p>\n
A NETIF_F_IPV6_CSUM device must parse through the outer headers to
\nreach the inner ones.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net: extend IPv6 exthdr detection of tunneled packets<\/p>\n
Commit c4336a07eb6b (“net: correctly handle tunneled traffic on IPV6_CSUM
\nGS<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-41324","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/41324","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=41324"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=41324"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=41324"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}