PT-2026-61237 · Linux · Linux
CVE-2026-63920
·
Publicado
2026-07-19
·
Atualizado
2026-07-19
CVSS v3.1
7.1
Alta
| Vetor | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H |
In the Linux kernel, the following vulnerability has been resolved:
ipv6: validate extension header length before copying to cmsg
ip6 datagram recv specific ctl() builds IPV6 {HOPOPTS,DSTOPTS,RTHDR}
cmsgs (and their IPV6 2292* legacy counterparts) by trusting the
on-wire hdrlen byte (ptr[1]) when computing the put cmsg() length.
The length was validated only at parse time (ipv6 parse hopopts(),
etc.). An nftables payload-write expression can rewrite hdrlen after
parsing and before the skb reaches recvmsg; the write itself is
in-bounds but put cmsg() then reads up to ((hdrlen+1) << 3) = 2040
bytes from an 8-byte header. nftables is reachable from an
unprivileged user namespace, so this is an unprivileged
slab-out-of-bounds read:
BUG: KASAN: slab-out-of-bounds in put cmsg+0x3ac/0x540
put cmsg+0x3ac/0x540
udpv6 recvmsg+0xca0/0x1250
sock recvmsg+0xdf/0x190
sys recvmsg+0x1b1/0x620
Add ipv6 get exthdr len() which validates that at least two bytes
are accessible before reading the hdrlen field, then checks the
computed length against skb tail pointer(skb), returning 0 on
failure. Extension headers are kept in the linear skb area by
pskb may pull() during input, so skb tail pointer() is the correct
bound.
Use ipv6 get exthdr len() at all non-AH call sites: the five
standalone cmsg blocks (HbH, 2292HbH, 2292DSTOPTS x2, 2292RTHDR)
and the three standard cases in the extension-header walk loop
(DSTOPTS, ROUTING, default). AH retains an inline bounds check
because its length formula differs ((ptr[1]+2)<<2).
The walk loop also gets a pre-read bounds check at the top to
validate ptr before any case accesses ptr[0] or ptr[1].
When the walk loop detects a corrupted header, return from the
function instead of continuing to process later socket options.
Correção
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Linux