In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ila: reload IPv6 header after pskb_may_pull in checksum adjust<\/p>\n
ila_csum_adjust_transport() caches ip6h = ipv6_hdr(skb) before calling
\npskb_may_pull(). On a non-linear skb whose transport header sits in a page
\nfragment, pskb_may_pull() can call __pskb_pull_tail() \/ pskb_expand_head()
\nand free the old skb head, leaving ip6h dangling; the following
\nget_csum_diff(ip6h, p) then reads freed memory. ila_update_ipv6_locator()
\nuses ip6h (and the iaddr derived from it) again after the csum-adjust
\ncall and additionally writes the new locator through that pointer.<\/p>\n
Impact: a remote IPv6 packet routed through a configured ILA
\ncsum-adjust-transport route or receive-side mapping triggers a
\nslab-use-after-free in ila_update_ipv6_locator() (KASAN). The route or
\nmapping requires CAP_NET_ADMIN to configure, but trigger packets are
\nunauthenticated once it exists.<\/p>\n
Reload ip6h after each pskb_may_pull() in ila_csum_adjust_transport()
\nbefore the csum-diff read. In ila_update_ipv6_locator() only the
\nILA_CSUM_ADJUST_TRANSPORT case pulls the skb, so reload ip6h and iaddr in
\nthat case alone before the destination-address write; the neutral-map
\nmodes never pull and keep their cached pointers.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ila: reload IPv6 header after pskb_may_pull in checksum adjust<\/p>\n
ila_csum_adjust_transport() caches ip6h = ipv6_hdr(skb) before call<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-5339","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/5339","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=5339"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=5339"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=5339"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}