Linux Kernel IPv6 Header Handling Vulnerability

A vulnerability in the Linux kernel's IPv6 extension header processing has been addressed. The issue arose because the function 'ip6_parse_tlv()' cached the network header while processing IPv6 Type Length Values (TLVs). The 'ipv6_dest_hao()' function could modify the header for cloned socket buffers, potentially invalidating the cached header pointer. The vulnerability required the network header to be refreshed after 'ipv6_dest_hao()' was called, ensuring that any additional padding or TLVs were correctly processed. This update aligns with the established protocol for handling TLVs that can alter header information.

Impact

The vulnerability could lead to improper handling of IPv6 extension headers, potentially causing issues in network communication or protocol processing.

Reproduction

The vulnerability can be reproduced by creating a cloned socket buffer and passing it through the IPv6 TLV parsing function 'ip6_parse_tlv()'. The 'ipv6_dest_hao()' function will then be called, which can expand the socket buffer's head and invalidate the cached network header. Without the necessary refresh, any trailing padding or TLVs may not be correctly parsed, leading to the vulnerability.

Remediation

Users can upgrade to the latest version of the Linux kernel where this vulnerability has been fixed. Instructions for downloading the patched kernel can be found on the official Linux kernel website.