Linux Kernel ESP Component Out-of-Bounds Write Vulnerability via MTU Underflow

A vulnerability in the Linux kernel's ESP component allows for an out-of-bounds write due to a mathematical underflow in the MTU calculation. This issue arises when an attacker manipulates certain parameters, leading to a negative value being interpreted as a large positive one. The vulnerability can be exploited by a user with no special privileges who establishes an IPv4 ESP tunnel with a large authentication key, sets a small MTU, and adjusts the TCP padding. When a UDP datagram is sent through this tunnel, the manipulated MTU value causes an underflow, resulting in a negative length being passed to a memory function, which then writes an excessive amount of data to an incorrect location in memory.

Impact

Exploitation of this vulnerability leads to a heap-based buffer overflow, where approximately 16 exabytes of zeroes are written to a memory location, causing a severe memory corruption issue.

Reproduction

To reproduce this vulnerability, first create an IPv4 ESP tunnel Security Association (SA) as a 'nobody' user, using a large authentication key (such as HMAC-SHA512 with a 64-byte key and 64-byte truncation). Next, configure the network interface MTU to a small value, such as 68 bytes, and set the TCP padding (XFRMA_TFCPAD) to a large value. Once this setup is complete, send a single UDP datagram through the tunnel. The 'xfrm_state_mtu' function will underflow the MTU value, and the 'esp_output' function will process this underflowed value as a signed integer. This negative value will be sign-extended and passed to 'memset' in the 'esp_output_fill_trailer' function', resulting in a massive write operation that corrupts memory.

Remediation

Users can update to the latest version of the Linux kernel where this vulnerability has been fixed. Instructions for updating the kernel can be found in the official Linux documentation.