Description
In the Linux kernel, the following vulnerability has been resolved: ip_vti: fix potential slab-use-after-free in decode_session6 When ip_vti device is set to the qdisc of the sfb type, the cb field of the sent skb may be modified during enqueuing. Then, slab-use-after-free may occur when ip_vti device sends IPv6 packets. As commit f855691975bb ("xfrm6: Fix the nexthdr offset in _decode_session6.") showed, xfrm_decode_session was originally intended only for the receive path. IP6CB(skb)->nhoff is not set during transmission. Therefore, set the cb field in the skb to 0 before sending packets.
Product status
f855691975bb06373a98711e4cfe2c224244b536 before 82fb41c5de243e7dfa90f32ca58e35adaff56c1d
f855691975bb06373a98711e4cfe2c224244b536 before 7dfe23659f3677c08a60a0056cda2d91a79c15ca
f855691975bb06373a98711e4cfe2c224244b536 before d34c30442d5e53a33cde79ca163320dbe2432cbd
f855691975bb06373a98711e4cfe2c224244b536 before 0b4d69539fdea138af2befe08893850c89248068
f855691975bb06373a98711e4cfe2c224244b536 before e1e04cc2ef2c0c0866c19f5627149a76c2baae32
f855691975bb06373a98711e4cfe2c224244b536 before 2b05bf5dc437f7891dd409a3eaf5058459391c7a
f855691975bb06373a98711e4cfe2c224244b536 before 78e397a43e1c47321a4679cc49a6c4530bf820b9
f855691975bb06373a98711e4cfe2c224244b536 before 6018a266279b1a75143c7c0804dd08a5fc4c3e0b
3.19
Any version before 3.19
4.14.324
4.19.293
5.4.255
5.10.192
5.15.128
6.1.47
6.4.12
6.5
References
git.kernel.org/...c/82fb41c5de243e7dfa90f32ca58e35adaff56c1d
git.kernel.org/...c/7dfe23659f3677c08a60a0056cda2d91a79c15ca
git.kernel.org/...c/d34c30442d5e53a33cde79ca163320dbe2432cbd
git.kernel.org/...c/0b4d69539fdea138af2befe08893850c89248068
git.kernel.org/...c/e1e04cc2ef2c0c0866c19f5627149a76c2baae32
git.kernel.org/...c/2b05bf5dc437f7891dd409a3eaf5058459391c7a
git.kernel.org/...c/78e397a43e1c47321a4679cc49a6c4530bf820b9
git.kernel.org/...c/6018a266279b1a75143c7c0804dd08a5fc4c3e0b
