Linux Kernel VLAN Protocol Handling Vulnerability in af_packet Component

A vulnerability in the Linux kernel's af_packet component has been addressed. The issue arose in the 'vlan_get_protocol_dgram()' function, which improperly handled the 'MSG_PEEK' flag. This oversight could lead to a kernel crash, as reported by syzbot. The flawed function version 6.13.0-rc4-syzkaller-00054-gd6ef8b40d075 was part of a commit that neglected to account for 'MSG_PEEK', allowing a crash to occur. The vulnerability was rooted in the function's manipulation of the socket buffer (skb), which could disrupt processing when accessed by multiple CPUs simultaneously. The issue triggered a kernel bug, indicating an invalid operation code, and was accompanied by a stack trace showing the error's origin in the 'net/core/skbuff.c' file.

Impact

Exploitation of this vulnerability leads to a kernel crash, causing a denial of service by interrupting normal system operations.

Reproduction

The vulnerability can be reproduced by invoking the 'vlan_get_protocol_dgram()' function with the 'MSG_PEEK' flag set. This can be done through a socket operation that peeks at incoming messages, such as using the 'recvmmsg' system call with the appropriate flags. The issue will manifest as a kernel crash, with the system outputting a 'kernel BUG' message and a stack trace indicating the crash's source.