Linux Kernel VXLAN Reuse of Cached IP Header Value Vulnerability Leading to Use-After-Free

A use-after-free vulnerability has been identified in the Linux kernel's VXLAN implementation. The issue arises from the improper handling of the IP header after performing Path Maximum Transmission Unit (PMTU) checks. Specifically, the function 'skb_tunnel_check_pmtu()' can modify the socket buffer's header, and reusing the cached IP header value can lead to a use-after-free condition. This vulnerability affects the Linux kernel's stable group.

Impact

Exploitation of this vulnerability can lead to a use-after-free condition, which may be exploited to execute arbitrary code or cause a denial-of-service condition by crashing the system.

Reproduction

The vulnerability can be reproduced by sending a VXLAN packet that requires PMTU discovery. The 'skb_tunnel_check_pmtu()' function will be called, potentially altering the packet's header. If the old cached IP header value is reused after this function call, it can create a use-after-free condition.

Remediation

Users can upgrade to the latest version of the Linux kernel where this vulnerability has been patched. Instructions for downloading the patched version are available on the official Linux kernel website.