Linux Kernel IPTunnel Header Handling Vulnerability Leading to Use-After-Free

A use-after-free vulnerability has been identified in the Linux kernel's IP tunneling implementation. The issue arises in the 'iptunnel_pmtud_build_icmp' and 'iptunnel_pmtud_build_icmpv6' functions, where network header information is cached before a critical operation that can modify the memory structure of the packet. This flaw could potentially be exploited to access freed memory, leading to undefined behavior.

Impact

Exploitation of this vulnerability could result in a use-after-free condition, allowing for memory corruption or arbitrary code execution.

Reproduction

The vulnerability can be reproduced by invoking the 'iptunnel_pmtud_build_icmp' or 'iptunnel_pmtud_build_icmpv6' functions with a crafted packet that takes advantage of the timing of the 'skb_cow' operation, which is responsible for copying the socket buffer. By manipulating the packet headers and the state of the socket buffer, it is possible to create a scenario where the cached header information is invalidated, leading to a use-after-free condition.

Remediation

Users can upgrade to the latest version of the Linux kernel where this vulnerability has been patched. Instructions for upgrading the kernel can be found in the official Linux documentation.