338 lines
17 KiB
JSON
338 lines
17 KiB
JSON
{
|
|
"dataType": "CVE_RECORD",
|
|
"dataVersion": "5.2",
|
|
"cveMetadata": {
|
|
"cveId": "CVE-2026-53221",
|
|
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"state": "PUBLISHED",
|
|
"assignerShortName": "Linux",
|
|
"dateReserved": "2026-06-09T07:44:35.392Z",
|
|
"datePublished": "2026-06-25T08:39:23.177Z",
|
|
"dateUpdated": "2026-10-19T19:57:29.527Z"
|
|
},
|
|
"containers": {
|
|
"cna": {
|
|
"providerMetadata": {
|
|
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"shortName": "Linux",
|
|
"dateUpdated": "2026-08-05T12:34:14.672Z"
|
|
},
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()\n\nIn vti6_tnl_lookup(), when an exact match for a tunnel fails,\nthe code falls back to searching for wildcard tunnels:\n\n- Tunnels matching the packet's local address, with any remote address\n wildcard remote).\n\n- Tunnels matching the packet's remote address, with any local address\n (wildcard local).\n\nHowever, vti6 stores all these different types of tunnels in the same\nhash table (ip6n->tnls_r_l) prone to hash collisions.\n\nThe bug is that the fallback search loops in vti6_tnl_lookup() were\nmissing checks to ensure that the candidate tunnel actually has\na wildcard address."
|
|
}
|
|
],
|
|
"metrics": [
|
|
{
|
|
"cvssV3_1": {
|
|
"version": "3.1",
|
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"baseScore": 9.8,
|
|
"baseSeverity": "CRITICAL"
|
|
},
|
|
"scenarios": [
|
|
{
|
|
"lang": "en",
|
|
"value": "AV:N - The vulnerable lookup is reached from IPv6 packet input through registered XFRM ESP/AH/IPComp and IP-in-IPv6 tunnel handlers, so a remote peer can trigger it with network traffic.\nAC:L - The bug is a deterministic missing wildcard-address check in a small hash table; once a plausible VTI6 configuration with colliding wildcard/exact tunnel entries exists, chosen packets reliably exercise the wrong lookup.\nPR:N - The packet receive path reaches `vti6_tnl_lookup()` before any per-packet authentication succeeds, and no local privilege is needed to send the triggering IPv6 traffic.\nUI:N - No victim user action is required; packets are processed by the kernel networking receive path.\nS:U - The impact remains within the kernel/networking security authority and does not by itself cross a VM, IOMMU, or host boundary.\nC:H - Wrong tunnel selection can associate decapsulated traffic with another VTI device, mark, and policy context; in a multi-tenant IPsec/VTI gateway this can expose tunneled plaintext across tunnel boundaries.\nI:H - The same confusion can deliver attacker-controlled inner packets under the wrong tunnel interface and policy context, enabling unauthorized modification or injection of traffic in the affected tunnel domain.\nA:H - Incorrect matching can consistently drop or misprocess traffic for affected tunnels, allowing loss of availability of the VTI/IPsec connectivity in vulnerable configurations."
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"affected": [
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "unaffected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"net/ipv6/ip6_vti.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "fbe68ee87522f6eaa10f9076c0a7117e1613f2f7",
|
|
"lessThan": "c327fa4fca31415431202e063767a7ae342e19c6",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "fbe68ee87522f6eaa10f9076c0a7117e1613f2f7",
|
|
"lessThan": "fc657ac0767c49839b3ef0b08dc0953ca30883f8",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "fbe68ee87522f6eaa10f9076c0a7117e1613f2f7",
|
|
"lessThan": "47fb3c2b4203556308e64354b3e78f2ce221d646",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "fbe68ee87522f6eaa10f9076c0a7117e1613f2f7",
|
|
"lessThan": "f513f308cc4bdb4530d033431592ffbc29b7fca1",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "fbe68ee87522f6eaa10f9076c0a7117e1613f2f7",
|
|
"lessThan": "90fd4513315ca07da99cfd8549d3e553a7160f0d",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "fbe68ee87522f6eaa10f9076c0a7117e1613f2f7",
|
|
"lessThan": "2abfb19bbb81958714ad1d43ebeb65b30394184b",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "fbe68ee87522f6eaa10f9076c0a7117e1613f2f7",
|
|
"lessThan": "2fc7bc087cc7085368263d9d37bfe9a0bddd6a2d",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "fbe68ee87522f6eaa10f9076c0a7117e1613f2f7",
|
|
"lessThan": "a5c0359f5cbc51a2e2b114d6041e0f3c73f903e9",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "affected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"net/ipv6/ip6_vti.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "3.19",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "0",
|
|
"lessThan": "3.19",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "5.10.259",
|
|
"lessThanOrEqual": "5.10.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "5.15.210",
|
|
"lessThanOrEqual": "5.15.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.1.176",
|
|
"lessThanOrEqual": "6.1.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.6.143",
|
|
"lessThanOrEqual": "6.6.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.12.94",
|
|
"lessThanOrEqual": "6.12.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.18.36",
|
|
"lessThanOrEqual": "6.18.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "7.0.13",
|
|
"lessThanOrEqual": "7.0.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "7.1",
|
|
"lessThanOrEqual": "*",
|
|
"status": "unaffected",
|
|
"versionType": "original_commit_for_fix"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"cpeApplicability": [
|
|
{
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "3.19",
|
|
"versionEndExcluding": "5.10.259"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "3.19",
|
|
"versionEndExcluding": "5.15.210"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "3.19",
|
|
"versionEndExcluding": "6.1.176"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "3.19",
|
|
"versionEndExcluding": "6.6.143"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "3.19",
|
|
"versionEndExcluding": "6.12.94"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "3.19",
|
|
"versionEndExcluding": "6.18.36"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "3.19",
|
|
"versionEndExcluding": "7.0.13"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "3.19",
|
|
"versionEndExcluding": "7.1"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/c327fa4fca31415431202e063767a7ae342e19c6"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/fc657ac0767c49839b3ef0b08dc0953ca30883f8"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/47fb3c2b4203556308e64354b3e78f2ce221d646"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/f513f308cc4bdb4530d033431592ffbc29b7fca1"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/90fd4513315ca07da99cfd8549d3e553a7160f0d"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/2abfb19bbb81958714ad1d43ebeb65b30394184b"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/2fc7bc087cc7085368263d9d37bfe9a0bddd6a2d"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/a5c0359f5cbc51a2e2b114d6041e0f3c73f903e9"
|
|
}
|
|
],
|
|
"title": "ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()",
|
|
"x_generator": {
|
|
"engine": "bippy-1.2.0"
|
|
}
|
|
},
|
|
"adp": [
|
|
{
|
|
"x_adpType": "supplier",
|
|
"providerMetadata": {
|
|
"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
|
|
"shortName": "siemens-SADP",
|
|
"dateUpdated": "2026-10-15T01:22:46.335Z"
|
|
},
|
|
"affected": [
|
|
{
|
|
"vendor": "Siemens",
|
|
"product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem",
|
|
"versions": [
|
|
{
|
|
"status": "affected",
|
|
"version": "0",
|
|
"lessThan": "*",
|
|
"versionType": "custom"
|
|
}
|
|
],
|
|
"defaultStatus": "unknown"
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"metrics": [
|
|
{
|
|
"other": {
|
|
"type": "ssvc",
|
|
"content": {
|
|
"id": "CVE-2026-53221",
|
|
"role": "CISA Coordinator",
|
|
"options": [
|
|
{
|
|
"Exploitation": "none"
|
|
},
|
|
{
|
|
"Automatable": "yes"
|
|
},
|
|
{
|
|
"Technical Impact": "total"
|
|
}
|
|
],
|
|
"version": "2.0.3",
|
|
"timestamp": "2026-10-16T15:27:05.371871Z"
|
|
}
|
|
}
|
|
}
|
|
],
|
|
"problemTypes": [
|
|
{
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"type": "CWE",
|
|
"cweId": "CWE-20",
|
|
"description": "CWE-20 Improper Input Validation"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"title": "CISA ADP Vulnrichment",
|
|
"providerMetadata": {
|
|
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
|
"shortName": "CISA-ADP",
|
|
"dateUpdated": "2026-10-19T19:57:29.527Z"
|
|
}
|
|
}
|
|
]
|
|
}
|
|
} |