Описание
In the Linux kernel, the following vulnerability has been resolved:
net: xfrm: reject unrepresentable espintcp transport headers
ESP-in-TCP can hand xfrm packets whose transport header offset no longer
fits after the stream parser trims the TCP envelope. The plain transport
header reset truncates that offset and triggers the skb warning path.
Use the careful transport-header helper and drop the skb through the
existing XFRM error path when the offset cannot be represented.
A flaw was found in the Linux kernel's XFRM (IPsec encryption framework) subsystem. A remote attacker could exploit this issue by sending specially crafted ESP-in-TCP (Encapsulating Security Payload over Transmission Control Protocol) packets with invalid transport header offsets. This improper handling triggers kernel warning paths and packet processing errors, potentially resulting in a Denial of Service (DoS).
Отчет
An Important-impact flaw was found in the Linux kernel's XFRM (IPsec) ESP-in-TCP (RFC 8229) encapsulation handling in net/xfrm/espintcp.c. When the TCP stream parser trims the TCP envelope from a received encapsulated packet, the resulting transport header offset can exceed the value the socket buffer's transport header offset field can represent. Resetting the transport header without validation truncates that offset and triggers the kernel's skb warning path, leading to packet processing errors and potentially a kernel panic. A remote, unauthenticated attacker able to send specially crafted ESP-in-TCP packets to a host configured for TCP encapsulation could exploit this flaw to cause a denial of service, with no impact on confidentiality or integrity (CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 7.5). The kernel and kernel-rt packages in Red Hat Enterprise Linux 8, 9, and 10, and the kernel packages in Red Hat In-Vehicle OS 2, are affected, and a fix is being pursued for those releases. Red Hat Enterprise Linux 6 and 7 (including kernel-rt) are not affected because the ESP-in-TCP encapsulation code that contains this flaw is not present in those kernel versions.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | kernel | Affected | ||
| Red Hat Enterprise Linux 6 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel | Affected | ||
| Red Hat Enterprise Linux 8 | kernel-rt | Affected | ||
| Red Hat Enterprise Linux 9 | kernel | Affected | ||
| Red Hat Enterprise Linux 9 | kernel-rt | Affected | ||
| Red Hat OpenShift Container Platform 4 | openshift/ose-rhel-coreos-8 | Affected | ||
| Red Hat OpenShift Container Platform 4 | openshift/ose-rhel-coreos-9 | Affected |
Показывать по
Дополнительная информация
Статус:
7.5 High
CVSS3
Связанные уязвимости
In the Linux kernel, the following vulnerability has been resolved: net: xfrm: reject unrepresentable espintcp transport headers ESP-in-TCP can hand xfrm packets whose transport header offset no longer fits after the stream parser trims the TCP envelope. The plain transport header reset truncates that offset and triggers the skb warning path. Use the careful transport-header helper and drop the skb through the existing XFRM error path when the offset cannot be represented.
In the Linux kernel, the following vulnerability has been resolved: net: xfrm: reject unrepresentable espintcp transport headers ESP-in-TCP can hand xfrm packets whose transport header offset no longer fits after the stream parser trims the TCP envelope. The plain transport header reset truncates that offset and triggers the skb warning path. Use the careful transport-header helper and drop the skb through the existing XFRM error path when the offset cannot be represented.
In the Linux kernel, the following vulnerability has been resolved: n ...
In the Linux kernel, the following vulnerability has been resolved: net: xfrm: reject unrepresentable espintcp transport headers ESP-in-TCP can hand xfrm packets whose transport header offset no longer fits after the stream parser trims the TCP envelope. The plain transport header reset truncates that offset and triggers the skb warning path. Use the careful transport-header helper and drop the skb through the existing XFRM error path when the offset cannot be represented.
7.5 High
CVSS3