{
  "threat_severity" : "Low",
  "public_date" : "2024-04-17T00:00:00Z",
  "bugzilla" : {
    "description" : "kernel: net: ip_tunnel: make sure to pull inner header in ip_tunnel_rcv()",
    "id" : "2275686",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2275686"
  },
  "cvss3" : {
    "cvss3_base_score" : "5.5",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
    "status" : "verified"
  },
  "cwe" : "CWE-158",
  "details" : [ "In the Linux kernel, the following vulnerability has been resolved:\nnet: ip_tunnel: make sure to pull inner header in ip_tunnel_rcv()\nApply the same fix than ones found in :\n8d975c15c0cd (\"ip6_tunnel: make sure to pull inner header in __ip6_tnl_rcv()\")\n1ca1ba465e55 (\"geneve: make sure to pull inner header in geneve_rx()\")\nWe have to save skb->network_header in a temporary variable\nin order to be able to recompute the network_header pointer\nafter a pskb_inet_may_pull() call.\npskb_inet_may_pull() makes sure the needed headers are in skb->head.\nsyzbot reported:\nBUG: KMSAN: uninit-value in __INET_ECN_decapsulate include/net/inet_ecn.h:253 [inline]\nBUG: KMSAN: uninit-value in INET_ECN_decapsulate include/net/inet_ecn.h:275 [inline]\nBUG: KMSAN: uninit-value in IP_ECN_decapsulate include/net/inet_ecn.h:302 [inline]\nBUG: KMSAN: uninit-value in ip_tunnel_rcv+0xed9/0x2ed0 net/ipv4/ip_tunnel.c:409\n__INET_ECN_decapsulate include/net/inet_ecn.h:253 [inline]\nINET_ECN_decapsulate include/net/inet_ecn.h:275 [inline]\nIP_ECN_decapsulate include/net/inet_ecn.h:302 [inline]\nip_tunnel_rcv+0xed9/0x2ed0 net/ipv4/ip_tunnel.c:409\n__ipgre_rcv+0x9bc/0xbc0 net/ipv4/ip_gre.c:389\nipgre_rcv net/ipv4/ip_gre.c:411 [inline]\ngre_rcv+0x423/0x19f0 net/ipv4/ip_gre.c:447\ngre_rcv+0x2a4/0x390 net/ipv4/gre_demux.c:163\nip_protocol_deliver_rcu+0x264/0x1300 net/ipv4/ip_input.c:205\nip_local_deliver_finish+0x2b8/0x440 net/ipv4/ip_input.c:233\nNF_HOOK include/linux/netfilter.h:314 [inline]\nip_local_deliver+0x21f/0x490 net/ipv4/ip_input.c:254\ndst_input include/net/dst.h:461 [inline]\nip_rcv_finish net/ipv4/ip_input.c:449 [inline]\nNF_HOOK include/linux/netfilter.h:314 [inline]\nip_rcv+0x46f/0x760 net/ipv4/ip_input.c:569\n__netif_receive_skb_one_core net/core/dev.c:5534 [inline]\n__netif_receive_skb+0x1a6/0x5a0 net/core/dev.c:5648\nnetif_receive_skb_internal net/core/dev.c:5734 [inline]\nnetif_receive_skb+0x58/0x660 net/core/dev.c:5793\ntun_rx_batched+0x3ee/0x980 drivers/net/tun.c:1556\ntun_get_user+0x53b9/0x66e0 drivers/net/tun.c:2009\ntun_chr_write_iter+0x3af/0x5d0 drivers/net/tun.c:2055\ncall_write_iter include/linux/fs.h:2087 [inline]\nnew_sync_write fs/read_write.c:497 [inline]\nvfs_write+0xb6b/0x1520 fs/read_write.c:590\nksys_write+0x20f/0x4c0 fs/read_write.c:643\n__do_sys_write fs/read_write.c:655 [inline]\n__se_sys_write fs/read_write.c:652 [inline]\n__x64_sys_write+0x93/0xd0 fs/read_write.c:652\ndo_syscall_x64 arch/x86/entry/common.c:52 [inline]\ndo_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83\nentry_SYSCALL_64_after_hwframe+0x63/0x6b\nUninit was created at:\n__alloc_pages+0x9a6/0xe00 mm/page_alloc.c:4590\nalloc_pages_mpol+0x62b/0x9d0 mm/mempolicy.c:2133\nalloc_pages+0x1be/0x1e0 mm/mempolicy.c:2204\nskb_page_frag_refill+0x2bf/0x7c0 net/core/sock.c:2909\ntun_build_skb drivers/net/tun.c:1686 [inline]\ntun_get_user+0xe0a/0x66e0 drivers/net/tun.c:1826\ntun_chr_write_iter+0x3af/0x5d0 drivers/net/tun.c:2055\ncall_write_iter include/linux/fs.h:2087 [inline]\nnew_sync_write fs/read_write.c:497 [inline]\nvfs_write+0xb6b/0x1520 fs/read_write.c:590\nksys_write+0x20f/0x4c0 fs/read_write.c:643\n__do_sys_write fs/read_write.c:655 [inline]\n__se_sys_write fs/read_write.c:652 [inline]\n__x64_sys_write+0x93/0xd0 fs/read_write.c:652\ndo_syscall_x64 arch/x86/entry/common.c:52 [inline]\ndo_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83\nentry_SYSCALL_64_after_hwframe+0x63/0x6b", "A flaw was found in the ip_tunnel implementation in the Linux kernel. This flaw occurs because the ip_tunnel_rcv() function does not properly pull the inner IP header before processing. A remote attacker could exploit this by sending crafted tunneled packets, potentially leading to a denial of service or incorrect packet handling. This impacts the integrity and availability of systems using IP tunneling." ],
  "affected_release" : [ {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2024-11-12T00:00:00Z",
    "advisory" : "RHSA-2024:9315",
    "cpe" : "cpe:/a:redhat:enterprise_linux:9",
    "package" : "kernel-0:5.14.0-503.11.1.el9_5"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2024-11-12T00:00:00Z",
    "advisory" : "RHSA-2024:9315",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9",
    "package" : "kernel-0:5.14.0-503.11.1.el9_5"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Out of support scope",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Out of support scope",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Out of support scope",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Fix deferred",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Fix deferred",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2024-26882\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-26882\nhttps://lore.kernel.org/linux-cve-announce/2024041741-CVE-2024-26882-be35@gregkh/T" ],
  "name" : "CVE-2024-26882",
  "csaw" : false
}