Описание
In the Linux kernel, the following vulnerability has been resolved:
netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop
The ah, hbh and rt matches check that the fixed extension header is
present, then use the header length field to derive the advertised
extension header length for matching.
For the ah match, add the missing advertised-length check. For hbh
and rt, update the existing advertised-length checks. In all three
cases, set hotdrop to true before returning false when the advertised
extension header length exceeds the available skb data.
Returning false treats the packet as a rule mismatch. Set hotdrop to
true and drop malformed packets so they cannot bypass rules intended
to drop packets with these IPv6 extension headers.
A flaw was found in the Linux kernel's netfilter subsystem, specifically within ip6tables. A remote attacker could send specially crafted IPv6 packets with malformed extension headers. Due to improper length checks, these malformed packets might not be correctly identified and dropped by ip6tables rules. This could allow an attacker to bypass intended security filtering policies.
Отчет
The IPv6 iptables AH, Hop-by-Hop (HBH), and Routing Header (RT) matches use extension-header length fields when evaluating packets. When a malformed IPv6 packet advertises an extension-header length larger than the data actually available in the skb, the affected match functions can return false without setting hotdrop. Netfilter therefore treats the malformed header as a normal rule mismatch rather than an invalid packet that must be dropped. As a result, specially crafted packets may bypass ip6tables rules intended to match and drop traffic containing these IPv6 extension headers.
The vulnerable path is remotely reachable when an affected IPv6 traffic path is exposed, and no local account, local code execution, authentication, or user interaction is required. For CVSS, AV:N/AC:L/PR:N/UI:N therefore reflects the remote unauthenticated attack surface. Exploitation is limited to systems using relevant ip6tables AH, HBH, or RT extension-header match rules.
The flaw does not itself cause an out-of-bounds memory access, kernel memory corruption, information disclosure, or denial of service. Its direct security impact is a firewall policy bypass. I:L reflects the ability to circumvent an administrator-defined packet-filtering decision. Any additional confidentiality or integrity impact depends on the services and security boundaries protected by the bypassed firewall rule rather than being a direct consequence of the kernel flaw. A paranoid assessment may therefore consider limited confidentiality and integrity impact if traffic that should have been blocked can reach otherwise protected services.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 6 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 7 | kernel-rt | Fix deferred | ||
| Red Hat Enterprise Linux 8 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 8 | kernel-rt | Fix deferred | ||
| Red Hat Enterprise Linux 9 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 9 | kernel-rt | Fix deferred |
Показывать по
Дополнительная информация
Статус:
5.3 Medium
CVSS3
Связанные уязвимости
In the Linux kernel, the following vulnerability has been resolved: netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop The ah, hbh and rt matches check that the fixed extension header is present, then use the header length field to derive the advertised extension header length for matching. For the ah match, add the missing advertised-length check. For hbh and rt, update the existing advertised-length checks. In all three cases, set hotdrop to true before returning false when the advertised extension header length exceeds the available skb data. Returning false treats the packet as a rule mismatch. Set hotdrop to true and drop malformed packets so they cannot bypass rules intended to drop packets with these IPv6 extension headers.
In the Linux kernel, the following vulnerability has been resolved: netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop The ah, hbh and rt matches check that the fixed extension header is present, then use the header length field to derive the advertised extension header length for matching. For the ah match, add the missing advertised-length check. For hbh and rt, update the existing advertised-length checks. In all three cases, set hotdrop to true before returning false when the advertised extension header length exceeds the available skb data. Returning false treats the packet as a rule mismatch. Set hotdrop to true and drop malformed packets so they cannot bypass rules intended to drop packets with these IPv6 extension headers.
In the Linux kernel, the following vulnerability has been resolved: n ...
5.3 Medium
CVSS3