Linux Kernel Combined Single-Frag Length Gate Restoration Vulnerability in ESP Processing

A vulnerability has been identified in the Linux kernel's handling of the Encapsulating Security Payload (ESP) in both IPv4 and IPv6. The issue arises in the fast path of ESP processing, where the trailer is added before the destination page fragment is allocated. This can lead to improper handling of data lengths, potentially causing the skb_page_frag_refill() function to revert to using a single page, while the destination scatter-gather still covers the combined data length. The vulnerability affects several versions of the Linux kernel.

Impact

The vulnerability could lead to improper management of network packet fragments, potentially causing performance issues or disrupting normal network operations.

Reproduction

The vulnerability can be reproduced by configuring the Linux kernel to use ESP for network traffic, and then sending packets that exceed the normal page size limit. This will trigger the faulty handling of packet fragments, demonstrating the vulnerability.

Remediation

Users can upgrade to the latest version of the Linux kernel where this vulnerability has been addressed. Instructions for upgrading the kernel can be found in the official Linux kernel documentation.