PT-2026-61242 · Linux · Linux
CVE-2026-63925
·
Publicado
2026-07-19
·
Atualizado
2026-07-19
CVSS v3.1
8.1
Alta
| Vetor | AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H |
In the Linux kernel, the following vulnerability has been resolved:
macsec: fix replay protection at XPN lower-PN wrap
In macsec post decrypt(), when pn is U32 MAX, pn + 1 overflows u32 to 0
and the first branch never fires. If next pn halves.lower is also in the
upper half, pn same half(pn, lower) is true and the XPN else-if does not
fire either, leaving next pn halves unchanged. An attacker that captures
the legitimate frame carrying pn == 0xFFFFFFFF on an XPN association
can then replay it indefinitely, since lowest pn never rises above
the captured pn and macsec decrypt() reconstructs the same IV.
Extend the XPN else-if to also fire when pn + 1 wraps to 0, so receipt
of pn == U32 MAX advances next pn halves to (upper + 1, 0).
Correção
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Linux