CVE-2024-26857

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: geneve: make sure to pull inner header in geneve_rx() syzbot triggered a bug in geneve_rx() [1] Issue is similar to the one I fixed in commit 8d975c15c0cd ("ip6_tunnel: make sure to pull inner header in __ip6_tnl_rcv()") We have to save skb->network_header in a temporary variable in order to be able to recompute the network_header pointer after a pskb_inet_may_pull() call. pskb_inet_may_pull() makes sure the needed headers are in skb->head. [1] BUG: KMSAN: uninit-value in IP_ECN_decapsulate include/net/inet_ecn.h:302 [inlin...

Affected product and versions

Product

Linux Linux, linux kernel, debian linux

Affected versions

>= 2d07dc79fe04a43d82a346ced6bbf07bdb523f1b < e431c3227864b5646601c97f5f898d99472f2914, >= 2d07dc79fe04a43d82a346ced6bbf07bdb523f1b < 59d2a4076983303f324557a114cfd5c32e1f6b29, >= 2d07dc79fe04a43d82a346ced6bbf07bdb523f1b < c7137900691f5692fe3de54566ea7b30bb35d66c, >= 2d07dc79fe04a43d82a346ced6bbf07bdb523f1b < e77e0b0f2a11735c64b105edaee54d6344faca8a, >= 2d07dc79fe04a43d82a346ced6bbf07bdb523f1b < c0b22568a9d8384fd000cc49acb8f74bde40d1b5, >= 2d07dc79fe04a43d82a346ced6bbf07bdb523f1b < 0ece581d2a66e8e488c0d3b3e7b5760dbbfdbdd5, >= 2d07dc79fe04a43d82a346ced6bbf07bdb523f1b < 048e16dee1fc609c1c85072ccd70bfd4b5fef6ca, >= 2d07dc79fe04a43d82a346ced6bbf07bdb523f1b < 1ca1ba465e55b9460e4e75dec9fff31e708fec74, >= 4.2, >= 4.2 < 4.19.310, >= 4.20 < 5.4.272, >= 5.5 < 5.10.213, >= 5.11 < 5.15.152, >= 5.16 < 6.1.82, >= 6.2 < 6.6.22, >= 6.7 < 6.7.10, 6.8, 10.0

Fixed versions

4.19.310, 5.4.272, 5.10.213, 5.15.152, 6.1.82, 6.6.22, 6.7.10

Technical data

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

CWE

CWE-908