PT-2026-36455 · Linux+1 · Linux Kernel+1
CVSS v2.0
10
High
| Vector | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
Description
An issue exists in the Linux kernel where the
ip6 err gen icmpv6 unreach() function fails to clear the skb2->cb[] array. When an outer IPv4 ICMP error packet is cloned into skb2 and passed to icmp6 send(), the system interprets IPv4 inet skb parm as inet6 skb parm. Specifically, the CIPSO offset in inet skb parm.opt overlaps with dsthao in inet6 skb parm at offset 18. An attacker can send a forged ICMPv4 error with a CIPSO IP option to set a non-zero dsthao offset. This causes mip6 addr swap() to use ipv6 find tlv() to scan the inner attacker-controlled IPv6 packet, potentially returning a fake TLV without verifying if the remaining packet length can accommodate the 18-byte struct ipv6 destopt hao. This may lead to a 16-byte swap that extends beyond the packet data into skb shared info.Recommendations
Apply the patch that clears the
cb array in the ip6 err gen icmpv6 unreach() function.Exploit
Fix
DoS
Type Confusion
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Linux Kernel
Rocky Linux