Описание
In the Linux kernel, the following vulnerability has been resolved:
seg6: validate SRH length before reading fixed fields
seg6_validate_srh() reads fixed SRH fields such as srh->type and
srh->hdrlen before checking that the supplied length covers the fixed
struct ipv6_sr_hdr fields.
The BPF SEG6 encap path reaches this with a BPF program-supplied pointer
and length: bpf_lwt_push_encap() and the SEG6 local BPF END_B6 and
END_B6_ENCAP actions call bpf_push_seg6_encap(), which forwards the
length to seg6_validate_srh() with no minimum-size guard. A 2-byte SEG6
encap header can therefore make the validator read srh->type at offset 2
beyond the caller-supplied buffer.
Reject lengths shorter than the fixed SRH at the top of
seg6_validate_srh(), before any field is read. This fixes the BPF helper
path and keeps the common validator robust.
A flaw was found in the Linux kernel's Segment Routing over IPv6 (SEG6) component. Insufficient validation of the Segment Routing Header (SRH) length before reading its fixed fields can lead to an out-of-bounds read. A local attacker, by crafting a malicious BPF (Berkeley Packet Filter) program, could provide a short SEG6 encapsulation header, causing the system to read beyond the allocated buffer. This could result in information disclosure or potentially a denial of service.
Отчет
An out-of-bounds read flaw rated Moderate by Red Hat was found in the Linux kernel's Segment Routing over IPv6 (SEG6) implementation in Red Hat Enterprise Linux and Red Hat In-Vehicle OS. The seg6_validate_srh() function reads fixed Segment Routing Header (SRH) fields, such as type and hdrlen, before checking that the supplied buffer length covers the fixed struct ipv6_sr_hdr fields. A local attacker able to load and attach a crafted BPF program, for example through bpf_lwt_push_encap() or the SEG6 local END_B6 and END_B6_ENCAP actions, could supply a 2-byte SEG6 encapsulation header and cause the kernel to read beyond the caller-supplied buffer. The over-read is limited to a few header bytes, so the practical impact is a small information disclosure or a local denial of service; there is no evidence of a write primitive or privilege escalation. Exploitation requires local access with privileges to load BPF programs (such as CAP_BPF or CAP_SYS_ADMIN), which limits exposure. Red Hat Enterprise Linux 6 and 7 are listed as not affected because the vulnerable code is not present in those streams. For the affected Red Hat Enterprise Linux 8, 9, and 10 and Red Hat In-Vehicle OS kernel streams the fix is currently deferred to a future update; the residual risk of deferring is considered low because of the local privilege requirement and the limited nature of the out-of-bounds read. Red Hat rates this flaw Moderate with CVSS 3.1 score 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), while the upstream CVE.org record scores it 7.8 (C:H/I:H/A:H); the difference reflects Red Hat's assessment that only a short header-field read is possible, with no supported confidentiality or integrity impact.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 6 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 8 | kernel-rt | Fix deferred | ||
| Red Hat Enterprise Linux 9 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 9 | kernel-rt | Fix deferred |
Показывать по
Дополнительная информация
Статус:
5.5 Medium
CVSS3
Связанные уязвимости
In the Linux kernel, the following vulnerability has been resolved: seg6: validate SRH length before reading fixed fields seg6_validate_srh() reads fixed SRH fields such as srh->type and srh->hdrlen before checking that the supplied length covers the fixed struct ipv6_sr_hdr fields. The BPF SEG6 encap path reaches this with a BPF program-supplied pointer and length: bpf_lwt_push_encap() and the SEG6 local BPF END_B6 and END_B6_ENCAP actions call bpf_push_seg6_encap(), which forwards the length to seg6_validate_srh() with no minimum-size guard. A 2-byte SEG6 encap header can therefore make the validator read srh->type at offset 2 beyond the caller-supplied buffer. Reject lengths shorter than the fixed SRH at the top of seg6_validate_srh(), before any field is read. This fixes the BPF helper path and keeps the common validator robust.
In the Linux kernel, the following vulnerability has been resolved: seg6: validate SRH length before reading fixed fields seg6_validate_srh() reads fixed SRH fields such as srh->type and srh->hdrlen before checking that the supplied length covers the fixed struct ipv6_sr_hdr fields. The BPF SEG6 encap path reaches this with a BPF program-supplied pointer and length: bpf_lwt_push_encap() and the SEG6 local BPF END_B6 and END_B6_ENCAP actions call bpf_push_seg6_encap(), which forwards the length to seg6_validate_srh() with no minimum-size guard. A 2-byte SEG6 encap header can therefore make the validator read srh->type at offset 2 beyond the caller-supplied buffer. Reject lengths shorter than the fixed SRH at the top of seg6_validate_srh(), before any field is read. This fixes the BPF helper path and keeps the common validator robust.
In the Linux kernel, the following vulnerability has been resolved: s ...
5.5 Medium
CVSS3