Linux Kernel Mirrored Blockcast Recursion Vulnerability Causes Stack Overflow

A stack overflow vulnerability has been identified in the Linux kernel's networking scheduler, specifically within the 'act_mirred' functionality. This issue arises from a recursion bypass related to blockcast actions, which can be exploited by unprivileged users in a new network namespace. The vulnerability allows for the creation of an infinite recursion loop between two network devices, ultimately leading to a kernel panic.

Impact

Exploitation of this vulnerability causes a stack overflow, triggering a kernel panic and halting the system.

Reproduction

The vulnerability can be reproduced by creating a user namespace that grants CAP_NET_ADMIN privileges. Within this namespace, two dummy network devices can be created and configured to share a Traffic Control (TC) egress block. A mirred blockcast rule is then applied, which mirrors packets from one device to the other. As the mirrored packets traverse the egress TC, the recursion loop is initiated, with the 'tcf_mirred_act' function being called repeatedly until the stack overflows.

Remediation

Users should apply the latest patches available in the Linux kernel stable tree to address this vulnerability.