Linux Kernel Macsec Replay Protection Vulnerability in XPN Lower-PN Wrap

A vulnerability in the Linux kernel's MACsec implementation allows for indefinite replay of frames under certain conditions. This issue arises when the packet number (PN) is at its maximum value, causing an overflow that disrupts proper sequence number handling. As a result, an attacker can capture and replay frames, exploiting the MACsec decryption process to reconstruct the same initialization vector (IV) and potentially interfere with secure communications.

Impact

The vulnerability allows an attacker to replay captured MACsec frames indefinitely, disrupting secure communications by causing the receiver to process the same frame multiple times as if it were new.

Reproduction

To reproduce this vulnerability, send a MACsec frame with a packet number (PN) of 0xFFFFFFFF. The receiver will not properly advance its sequence number, allowing the frame to be replayed indefinitely.

Remediation

Users can upgrade to the latest stable version of the Linux kernel, where this vulnerability has been addressed.