Linux Kernel Mirrored Loop Vulnerability in Traffic Control

A vulnerability exists in the Linux kernel's traffic control subsystem, specifically within the mirred action handling. When mirred redirects to the ingress from either ingress or egress, the loop state is lost. This occurs because the packet is deferred into the backlog and the sched_mirred_dev array is cleared. As a result, any existing loop may go undetected. The vulnerability affects the stable versions of the Linux kernel.

Impact

Exploitation of this vulnerability can lead to undetected looping in network traffic, potentially causing network disruptions or degraded performance.

Reproduction

The vulnerability can be reproduced by adding an IP address to a network interface and then setting up traffic control (tc) filters that create a loop between two interfaces using mirred actions. After establishing the loop, a ping can be sent that may not be properly processed due to the cleared loop state, allowing the loop to go undetected.

Remediation

Users can update to the latest patched version of the Linux kernel to address this vulnerability.