Linux Kernel Unprivileged Slab-Out-of-Bounds Read Vulnerability in IPv6 Extension Header Handling

A vulnerability in the Linux kernel's handling of IPv6 extension headers can lead to an unprivileged slab-out-of-bounds read. This issue arises in the 'ip6_datagram_recv_specific_ctl()' function, which processes certain control messages by relying on the 'hdrlen' byte from the header. The vulnerability exists because the length validation is only performed when parsing the header, not before the data is copied to the control message. An nftables payload-write expression can manipulate the 'hdrlen' value after parsing, creating an opportunity for exploitation. This vulnerability is accessible from an unprivileged user namespace.

Impact

Exploitation of this vulnerability causes a slab-out-of-bounds read, which can potentially lead to information disclosure or memory corruption.

Reproduction

The vulnerability can be reproduced by sending an IPv6 packet with a crafted extension header that overwrites the 'hdrlen' value. This can be done using nftables to manipulate the header after it has been parsed, but before it is processed by the 'recvmsg' system call'.

Remediation

Users can upgrade to the latest version of the Linux kernel, where this vulnerability has been addressed. Instructions for upgrading can be found in the official Linux kernel documentation.