Описание
In the Linux kernel, the following vulnerability has been resolved:
xfrm: ah6: validate routing header segments_left
AH6 rearranges routing-header addresses before computing or verifying the
ICV. ipv6_rearrange_rthdr() assumes that segments_left is not larger than
the number of addresses described by the routing header's hdrlen field.
That assumption does not hold for raw IPv6 HDRINCL packets. A packet with
hdrlen equal to 2 describes one address, but can carry an arbitrary
segments_left value. With segments_left equal to 255, the function moves
its address pointer 4,064 bytes backwards and passes a 4,064-byte length to
memmove(), resulting in an out-of-bounds access.
Validate the invariant locally before modifying the routing header or
performing any address-pointer arithmetic, and propagate malformed-header
errors to the existing AH6 input and output error paths.
A flaw was found in the Linux kernel's xfrm subsystem, specifically within the AH6 (Authentication Header for IPv6) module. The ipv6_rearrange_rthdr() function does not properly validate the segments_left field in routing headers when processing raw IPv6 HDRINCL packets. This oversight allows an attacker to craft a malicious packet that can cause an out-of-bounds memory access, potentially leading to memory corruption.
Отчет
This issue is classified as Important severity because exploitation can be achieved by a local attacker with unprivileged user access. An attack could leverage user namespaces to obtain elevated network permissions within the namespace, then sends specially crafted IPv6 packets with malformed Authentication Header routing headers. Exploitation is challenging but achievable due to complex setup including IPv6 AH/XFRM, ESP-in-UDP encapsulation, and specific timing and memory layout conditions. This memory corruption can enable local privilege escalation to root from an unprivileged user account.
Меры по смягчению последствий
See the security bulletin for a detailed mitigation procedure.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 9 | kernel-rt | Will not fix | ||
| Red Hat OpenShift Container Platform 4 | openshift/ose-rhel-coreos-8 | Affected | ||
| NVIDIA for RHEL 10 | kernel | Fixed | RHSA-2026:74974 | 02.10.2026 |
| Red Hat Enterprise Linux 10 | kernel | Fixed | RHSA-2026:71233 | 24.09.2026 |
| Red Hat Enterprise Linux 10.0 Extended Update Support | kernel | Fixed | RHSA-2026:71599 | 24.09.2026 |
| Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION | kernel | Fixed | RHSA-2026:71649 | 24.09.2026 |
| Red Hat Enterprise Linux 7 Extended Lifecycle Support | kernel-rt | Fixed | RHSA-2026:71657 | 24.09.2026 |
| Red Hat Enterprise Linux 7 Extended Lifecycle Support | kernel | Fixed | RHSA-2026:71687 | 24.09.2026 |
| Red Hat Enterprise Linux 8 | kernel-rt | Fixed | RHSA-2026:71016 | 23.09.2026 |
| Red Hat Enterprise Linux 8 | kernel | Fixed | RHSA-2026:71213 | 24.09.2026 |
Показывать по
Дополнительная информация
Статус:
EPSS
8.3 High
CVSS3
Связанные уязвимости
In the Linux kernel, the following vulnerability has been resolved: xfrm: ah6: validate routing header segments_left AH6 rearranges routing-header addresses before computing or verifying the ICV. ipv6_rearrange_rthdr() assumes that segments_left is not larger than the number of addresses described by the routing header's hdrlen field. That assumption does not hold for raw IPv6 HDRINCL packets. A packet with hdrlen equal to 2 describes one address, but can carry an arbitrary segments_left value. With segments_left equal to 255, the function moves its address pointer 4,064 bytes backwards and passes a 4,064-byte length to memmove(), resulting in an out-of-bounds access. Validate the invariant locally before modifying the routing header or performing any address-pointer arithmetic, and propagate malformed-header errors to the existing AH6 input and output error paths.
In the Linux kernel, the following vulnerability has been resolved: xfrm: ah6: validate routing header segments_left AH6 rearranges routing-header addresses before computing or verifying the ICV. ipv6_rearrange_rthdr() assumes that segments_left is not larger than the number of addresses described by the routing header's hdrlen field. That assumption does not hold for raw IPv6 HDRINCL packets. A packet with hdrlen equal to 2 describes one address, but can carry an arbitrary segments_left value. With segments_left equal to 255, the function moves its address pointer 4,064 bytes backwards and passes a 4,064-byte length to memmove(), resulting in an out-of-bounds access. Validate the invariant locally before modifying the routing header or performing any address-pointer arithmetic, and propagate malformed-header errors to the existing AH6 input and output error paths.
In the Linux kernel, the following vulnerability has been resolved: x ...
In the Linux kernel, the following vulnerability has been resolved: xfrm: ah6: validate routing header segments_left AH6 rearranges routing-header addresses before computing or verifying the ICV. ipv6_rearrange_rthdr() assumes that segments_left is not larger than the number of addresses described by the routing header's hdrlen field. That assumption does not hold for raw IPv6 HDRINCL packets. A packet with hdrlen equal to 2 describes one address, but can carry an arbitrary segments_left value. With segments_left equal to 255, the function moves its address pointer 4,064 bytes backwards and passes a 4,064-byte length to memmove(), resulting in an out-of-bounds access. Validate the invariant locally before modifying the routing header or performing any address-pointer arithmetic, and propagate malformed-header errors to the existing AH6 input and output error paths.
EPSS
8.3 High
CVSS3