Andrew Lukoshko
e44942141f
Backport upstream stable fixes for RHEL-Affected Important CVEs, closest-to-6.12 stable base, verified zero-fuzz on 211.34.1 (patches 1100-1112): CVE-2026-53398 53399 63794 63797 63824 63829 64037 64042 64051 64061 64113 64132 64191
69 lines
2.6 KiB
Diff
69 lines
2.6 KiB
Diff
From 769723124b7c3b2bfea4cf68ad292698b87c8d01 Mon Sep 17 00:00:00 2001
|
|
From: Justin Iurman <justin.iurman@gmail.com>
|
|
Date: Wed, 20 May 2026 14:42:42 +0200
|
|
Subject: [PATCH] ipv6: ioam: refresh hdr pointer before ioam6_event()
|
|
|
|
commit e46e6bc97fb1f339730ff1ba74267fbf48e7a422 upstream.
|
|
|
|
Reported by Sashiko:
|
|
|
|
In ipv6_hop_ioam(), the hdr pointer is initialized to point into the
|
|
skb's linear data buffer. Later, the code calls skb_ensure_writable(),
|
|
which might reallocate the buffer:
|
|
|
|
if (skb_ensure_writable(skb, optoff + 2 + hdr->opt_len))
|
|
goto drop;
|
|
|
|
/* Trace pointer may have changed */
|
|
trace = (struct ioam6_trace_hdr *)(skb_network_header(skb)
|
|
+ optoff + sizeof(*hdr));
|
|
|
|
ioam6_fill_trace_data(skb, ns, trace, true);
|
|
|
|
ioam6_event(IOAM6_EVENT_TRACE, dev_net(skb->dev),
|
|
GFP_ATOMIC, (void *)trace, hdr->opt_len - 2);
|
|
|
|
If the skb is cloned or lacks sufficient linear headroom,
|
|
skb_ensure_writable() will invoke pskb_expand_head(), which reallocates
|
|
the skb's data buffer and frees the old one, invalidating pointers to
|
|
it. While the code recalculates the trace pointer immediately after the
|
|
call to skb_ensure_writable(), it fails to recalculate the hdr pointer.
|
|
|
|
This patch fixes the above by recalculating the hdr pointer before
|
|
passing hdr->opt_len to ioam6_event(), so that we avoid any UaF.
|
|
|
|
Fixes: f655c78d6225 ("net: exthdrs: ioam6: send trace event")
|
|
Cc: stable@vger.kernel.org
|
|
Signed-off-by: Justin Iurman <justin.iurman@gmail.com>
|
|
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
|
|
Link: https://patch.msgid.link/20260520124242.32320-1-justin.iurman@gmail.com
|
|
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
|
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
|
|
CVE-2026-64132
|
|
|
|
Backported from linux-6.12.y commit 769723124b7c3b2bfea4cf68ad292698b87c8d01
|
|
(mainline e46e6bc97fb1f339730ff1ba74267fbf48e7a422); applies cleanly to the
|
|
a10 kernel-6.12.0-211.34.1.el10_2 tree, zero-fuzz (line offset only).
|
|
|
|
diff --git a/net/ipv6/exthdrs.c b/net/ipv6/exthdrs.c
|
|
index d09ae48030b3..a330aaf70b5a 100644
|
|
--- a/net/ipv6/exthdrs.c
|
|
+++ b/net/ipv6/exthdrs.c
|
|
@@ -957,9 +957,9 @@ static bool ipv6_hop_ioam(struct sk_buff *skb, int optoff)
|
|
if (skb_ensure_writable(skb, optoff + 2 + hdr->opt_len))
|
|
goto drop;
|
|
|
|
- /* Trace pointer may have changed */
|
|
- trace = (struct ioam6_trace_hdr *)(skb_network_header(skb)
|
|
- + optoff + sizeof(*hdr));
|
|
+ /* Trace and hdr pointers may have changed */
|
|
+ hdr = (struct ioam6_hdr *)(skb_network_header(skb) + optoff);
|
|
+ trace = (struct ioam6_trace_hdr *)((u8 *)hdr + sizeof(*hdr));
|
|
|
|
ioam6_fill_trace_data(skb, ns, trace, true);
|
|
|
|
--
|
|
2.50.1 (Apple Git-155)
|
|
|