Описание
In the Linux kernel, the following vulnerability has been resolved:
vxlan: Fix potential null-ptr-deref in vxlan_gro_prepare_receive().
udp_tunnel_sock_release() could set sk->sk_user_data to NULL
while vxlan_gro_prepare_receive() is running.
Let's check if rcu_dereference_sk_user_data() is NULL after
skb_gro_remcsum_init().
A flaw was found in the Linux kernel's Virtual Extensible LAN (VXLAN) component. A race condition can occur where the udp_tunnel_sock_release() function sets a socket's user data to NULL while the vxlan_gro_prepare_receive() function is still actively using it. This could lead to a null pointer dereference, potentially causing a system crash or denial of service.
Отчет
A moderate impact NULL pointer dereference flaw was found in the Linux kernel's Virtual Extensible LAN (VXLAN) implementation, affecting Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 10, and Red Hat In-Vehicle OS 2. A race condition can occur in which udp_tunnel_sock_release() sets a socket's user data (sk_user_data) to NULL while vxlan_gro_prepare_receive() is still using it to process received VXLAN packets. If this race is triggered while packet reception on a VXLAN tunnel coincides with tunnel socket teardown, the kernel dereferences the NULL pointer, causing a kernel crash and denial of service. No impact to confidentiality or integrity is expected, and successful exploitation depends on hitting a narrow timing window between socket release and packet reception. Red Hat Enterprise Linux 6, 7, and 8 are not affected because the vulnerable code is not present in those supported streams. The fix for the affected Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 10, and Red Hat In-Vehicle OS 2 releases has been deferred and is planned to be addressed in a future update. Until a fix is delivered, the residual risk is limited to a potential kernel crash (denial of service) if the race condition is triggered. Red Hat rates this flaw as Moderate severity (CVSS 3.1 score 5.5), which differs from the upstream CVE.org score of 9.8 (Critical). The upstream score assumes a network attack vector with high confidentiality and integrity impact, whereas the verified technical evidence shows a denial-of-service-only NULL pointer dereference that depends on winning a narrow race during tunnel teardown.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 6 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 9 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 9 | kernel-rt | Fix deferred |
Показывать по
Дополнительная информация
Статус:
EPSS
5.5 Medium
CVSS3
Связанные уязвимости
In the Linux kernel, the following vulnerability has been resolved: vxlan: Fix potential null-ptr-deref in vxlan_gro_prepare_receive(). udp_tunnel_sock_release() could set sk->sk_user_data to NULL while vxlan_gro_prepare_receive() is running. Let's check if rcu_dereference_sk_user_data() is NULL after skb_gro_remcsum_init().
In the Linux kernel, the following vulnerability has been resolved: vxlan: Fix potential null-ptr-deref in vxlan_gro_prepare_receive(). udp_tunnel_sock_release() could set sk->sk_user_data to NULL while vxlan_gro_prepare_receive() is running. Let's check if rcu_dereference_sk_user_data() is NULL after skb_gro_remcsum_init().
In the Linux kernel, the following vulnerability has been resolved: v ...
EPSS
5.5 Medium
CVSS3