Linux Kernel Tunnels Module Out-of-Bounds Access Vulnerability in PMTUD ICMP Handling

A vulnerability in the Linux kernel's tunnels module can lead to an out-of-bounds access in the Path Maximum Transmission Unit (PMTU) discovery process for ICMP packets. This issue arises because the transport header of the socket buffer (skb) may not be set, causing the ICMP header to be accessed based on the IPv4 network header without proper validation. The vulnerability affects several versions of the Linux kernel.

Impact

Exploitation of this vulnerability causes a memory access error, which can lead to undefined behavior such as memory corruption or a crash.

Reproduction

The vulnerability can be reproduced by sending ICMP packets through a tunnel when the transport header is not set. This can be done by directly bridging IP packets over a tunnel interface, which bypasses the normal IP handling and can result in the transport header being unset. Once the ICMP packets are received, the 'iptunnel_pmtud_check_icmp' function will be called without a valid transport header, triggering the out-of-bounds access.

Remediation

Users can upgrade to the latest stable version of the Linux kernel, where this vulnerability has been fixed. Instructions for downloading the latest version can be found on the official Linux kernel website.