180 lines
11 KiB
JSON
180 lines
11 KiB
JSON
{
|
|
"dataType": "CVE_RECORD",
|
|
"dataVersion": "5.2",
|
|
"cveMetadata": {
|
|
"cveId": "CVE-2026-64132",
|
|
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"state": "PUBLISHED",
|
|
"assignerShortName": "Linux",
|
|
"dateReserved": "2026-07-19T07:54:57.036Z",
|
|
"datePublished": "2026-07-19T15:40:27.590Z",
|
|
"dateUpdated": "2026-08-05T12:39:34.060Z"
|
|
},
|
|
"containers": {
|
|
"cna": {
|
|
"providerMetadata": {
|
|
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"shortName": "Linux",
|
|
"dateUpdated": "2026-08-05T12:39:34.060Z"
|
|
},
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: ioam: refresh hdr pointer before ioam6_event()\n\nReported by Sashiko:\n\nIn ipv6_hop_ioam(), the hdr pointer is initialized to point into the\nskb's linear data buffer. Later, the code calls skb_ensure_writable(),\nwhich might reallocate the buffer:\n\n\tif (skb_ensure_writable(skb, optoff + 2 + hdr->opt_len))\n\t\tgoto drop;\n\n\t/* Trace pointer may have changed */\n\ttrace = (struct ioam6_trace_hdr *)(skb_network_header(skb)\n\t\t\t\t\t + optoff + sizeof(*hdr));\n\n\tioam6_fill_trace_data(skb, ns, trace, true);\n\n\tioam6_event(IOAM6_EVENT_TRACE, dev_net(skb->dev),\n\t\t GFP_ATOMIC, (void *)trace, hdr->opt_len - 2);\n\nIf the skb is cloned or lacks sufficient linear headroom,\nskb_ensure_writable() will invoke pskb_expand_head(), which reallocates\nthe skb's data buffer and frees the old one, invalidating pointers to\nit. While the code recalculates the trace pointer immediately after the\ncall to skb_ensure_writable(), it fails to recalculate the hdr pointer.\n\nThis patch fixes the above by recalculating the hdr pointer before\npassing hdr->opt_len to ioam6_event(), so that we avoid any UaF."
|
|
}
|
|
],
|
|
"metrics": [
|
|
{
|
|
"cvssV3_1": {
|
|
"version": "3.1",
|
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"baseScore": 9.8,
|
|
"baseSeverity": "CRITICAL"
|
|
},
|
|
"scenarios": [
|
|
{
|
|
"lang": "en",
|
|
"value": "AV:N - The bug is in `ipv6_hop_ioam()`, reached from `ipv6_rcv()` → `ip6_rcv_core()` → `ipv6_parse_hopopts()` → `ip6_parse_tlv()` when processing IPv6 hop-by-hop IOAM options on ingress. A remote attacker can deliver the trigger with a crafted IPv6 packet to any internet-facing or LAN-reachable host/router that has IOAM ingress enabled.\nAC:L - Exploitation requires `skb_ensure_writable()` to reallocate via `pskb_expand_head()`, which occurs when the skb is cloned (e.g., bridge flooding/multicast forwarding sets `skb->cloned` on the original before local delivery to the IP stack). An attacker can reliably create this condition with concurrent traffic/topology choices rather than depending on uncontrollable timing or memory layout.\nPR:N - The attacker needs no privileges on the victim system—only the ability to send IPv6 packets. IOAM namespace/sysctl configuration is a victim-side deployment prerequisite (typical on carrier/ISP telemetry nodes), not a privilege the attacker must hold.\nUI:N - Exploitation is fully attacker-driven by sending a malicious IPv6 packet and requires no action from a victim user.\nS:U - The vulnerability is a kernel heap use-after-free in IPv6 packet processing; successful exploitation would compromise the kernel/host itself, not cross a separate security authority such as a VM guest-to-host or sandbox boundary.\nC:H - After `pskb_expand_head()` frees the old skb buffer, the stale `hdr` pointer is dereferenced for `hdr->opt_len`, constituting a use-after-free read of freed kernel memory; that attacker-influenced length is then used in `ioam6_event_put_trace()`/`nla_put()`, enabling out-of-bounds kernel memory reads and information disclosure.\nI:H - Use-after-free of heap metadata enables memory corruption primitives; the corrupted `opt_len` fed into netlink attribute construction can cause out-of-bounds reads whose contents are attacker-influenced, and UAF bugs in skb handling are classically leveragable toward arbitrary kernel write/code execution.\nA:H - Reading freed memory and passing a corrupted length into `nla_put()` can cause kernel oops/panic (especially with KASAN/overflow checks), and UAF conditions inherently risk system crashes even when full exploitation is not attempted."
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"affected": [
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "unaffected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"net/ipv6/exthdrs.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "f655c78d6225f585ef60a9d93ffb79d507ff3ad3",
|
|
"lessThan": "769723124b7c3b2bfea4cf68ad292698b87c8d01",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "f655c78d6225f585ef60a9d93ffb79d507ff3ad3",
|
|
"lessThan": "24de676da63c1122d2c13b0d546238b66d1b4e62",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "f655c78d6225f585ef60a9d93ffb79d507ff3ad3",
|
|
"lessThan": "5af905aa8e91ff8d94572a1e089558f21dcf24ed",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "f655c78d6225f585ef60a9d93ffb79d507ff3ad3",
|
|
"lessThan": "e46e6bc97fb1f339730ff1ba74267fbf48e7a422",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "affected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"net/ipv6/exthdrs.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "6.9",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "0",
|
|
"lessThan": "6.9",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.12.92",
|
|
"lessThanOrEqual": "6.12.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.18.34",
|
|
"lessThanOrEqual": "6.18.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "7.0.11",
|
|
"lessThanOrEqual": "7.0.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "7.1",
|
|
"lessThanOrEqual": "*",
|
|
"status": "unaffected",
|
|
"versionType": "original_commit_for_fix"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"cpeApplicability": [
|
|
{
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.9",
|
|
"versionEndExcluding": "6.12.92"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.9",
|
|
"versionEndExcluding": "6.18.34"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.9",
|
|
"versionEndExcluding": "7.0.11"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.9",
|
|
"versionEndExcluding": "7.1"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/769723124b7c3b2bfea4cf68ad292698b87c8d01"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/24de676da63c1122d2c13b0d546238b66d1b4e62"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/5af905aa8e91ff8d94572a1e089558f21dcf24ed"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/e46e6bc97fb1f339730ff1ba74267fbf48e7a422"
|
|
}
|
|
],
|
|
"title": "ipv6: ioam: refresh hdr pointer before ioam6_event()",
|
|
"x_generator": {
|
|
"engine": "bippy-1.2.0"
|
|
}
|
|
}
|
|
}
|
|
} |