CyberRota Analysis
AI-GeneratedThe vulnerability affects the Linux kernel's handling of packets in the vector_mmsg_rx() function, specifically related to a use-after-free condition that occurs when a packet is discarded due to a failed header verification. This flaw can lead to a refcount underflow, potentially allowing an attacker to exploit the situation on GRE and L2TPv3 transports without authentication, resulting in system instability or unauthorized access. Organizations using Linux systems with these transport protocols should prioritize addressing this vulnerability to mitigate potential exploitation risks.
Original NVD Description
In the Linux kernel, the following vulnerability has been resolved: um: vector: fix use-after-free in vector_mmsg_rx() When vector_mmsg_rx() discards a packet whose overlay header fails verify_header(), it frees the skb and continues the loop: if (header_check < 0) { dev_kfree_skb_irq(skb); vp->estats.rx_encaps_errors++; continue; } The normal and short-packet paths fall through to the bottom of the loop body, which clears the consumed slot and advances the cursors: (*skbuff_vector) = NULL; mmsg_vector++; skbuff_vector++; The verify_header() < 0 path skips that via continue, so the freed skb is left in skbuff_vector[] and the cursors do not advance. The next iteration reads the same slot, gets the freed skb, and frees it again, producing a refcount underflow / use-after-free in the RX path. Discard the slot the same way the other paths do before continuing. Only transports whose verify_header() can return negative are affected: GRE and L2TPv3 do so on a cookie/session-id mismatch (raw/tap do not), so any peer on such a transport can trigger it without authentication.