Linux Kernel VTI6 Tunnel Namespace Change Vulnerability Leading to Use-After-Free

A vulnerability in the Linux kernel's VTI6 (Virtual Tunnel Interface version 6) implementation allows for a use-after-free condition. This issue arises from improper handling of network namespaces, which can be exploited by an unprivileged user in a container environment. The vulnerability was introduced in a previous commit that enabled namespace changing for VTI6 devices, but failed to maintain proper references during the transition, leaving stale entries that can be cleaned up improperly, potentially leading to memory corruption.

Impact

Exploitation of this vulnerability causes a kernel bug, with the system logging a critical error and potentially allowing for memory corruption.

Reproduction

The vulnerability can be reproduced by creating two network namespaces and adding a VTI6 link in one namespace, then moving it to another. This process can be automated with a script that uses the 'ip' command to manage network namespaces and VTI6 links. After the link is moved, the vulnerability manifests as a kernel bug, indicating a use-after-free error.

Remediation

Users can upgrade to the latest stable version of the Linux kernel, where this vulnerability has been fixed.