Linux Kernel GARP Attribute Parser Integer Underflow Vulnerability

A vulnerability in the Linux kernel's GARP (Generic Attribute Registration Protocol) attribute parser has been identified, specifically in the receive-side processing of GARP attributes. The issue arises from the parser incorrectly calculating the data length by subtracting the on-wire attribute length (which includes the GARP header) from the size of the attribute structure. This miscalculation creates an unsigned integer underflow, as normal attributes with data have a length greater than the size of the structure. The underflowed value is then truncated and passed to the `garp_attr_lookup()` function, leading to a mismatch between the parsed data length and the length of locally registered attributes. As a result, GARP Join/Leave events are ignored, disrupting the GARP receive path for common attributes like GVRP VLAN registration. The vulnerability affects several versions of the Linux kernel.

Impact

Exploitation of this vulnerability disrupts the GARP receive path for common attributes, such as GVRP VLAN registration, by causing the parser to ignore received Join/Leave events. This could lead to improper handling of VLAN registrations, potentially causing network misconfigurations or disruptions.

Reproduction

The vulnerability can be reproduced by sending GARP packets with attributes that include data, such as GVRP VLAN registration attributes. The GARP attribute parser will incorrectly compute the data length due to the unsigned integer underflow, leading to a failure in processing the GARP events correctly.

Remediation

The vulnerability has been fixed in the Linux kernel. Users should upgrade to the latest version of the stable Linux kernel to apply the patch.