CVE-2024-26665
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
In the Linux kernel, in tunnel functions (e.g., VXLAN), there is an out-of-bounds read when building IPv6 PMTU errors. The issue occurs when the ICMPv6 error is built from a non-linear skb, leading to memory corruption (KASAN: slab-out-of-bounds).
Risk Assessment
This can lead to information disclosure, system crashes, or remote code execution if exploited by an attacker, especially in network environments with tunnels.
Recommendation
It is recommended to update the Linux kernel to a version with the fix that uses skb_checksum instead of csum_partial for non-linear skbs.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: tunnels: fix out of bounds access when building IPv6 PMTU error If the ICMPv6 error is built from a non-linear skb we get the following splat, BUG: KASAN: slab-out-of-bounds in do_csum+0x220/0x240 Read of size 4 at addr ffff88811d402c80 by task netperf/820 CPU: 0 PID: 820 Comm: netperf Not tainted 6.8.0-rc1+ #543 ... kasan_report+0xd8/0x110 do_csum+0x220/0x240 csum_partial+0xc/0x20 skb_tunnel_check_pmtu+0xeb9/0x3280 vxlan_xmit_one+0x14c2/0x4080 vxlan_xmit+0xf61/0x5c00 dev_hard_start_xmit+0xfb/0x510 __dev_queue_xmit+0x7cd/0x32a0 br_dev_queue_push_xmit+0x39d/0x6a0 Use skb_checksum instead of csum_partial who cannot deal with non-linear SKBs.