In the Linux kernel, the following vulnerability has been resolved:
batman-adv: access unicast_ttvn skb->data only after skb realloc
The pskb_may_pull() called by batadv_get_vid() could reallocate the buffer
behind the skb. Variables which were pointing to the old buffer need to be
reassigned to avoid an use-after-free.
This was done correctly for the ethernet header but missed for the
unicast_packet pointer.
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 9.8
AV:N - Triggered in batadv_check_unicast_ttvn() when batadv_batman_skb_recv() processes incoming BATADV unicast packets from remote mesh peers on hard interfaces; crafted batman-adv frames reach the vulnerable code over the mesh network without local system access.
AC:L - An attacker reliably triggers the UAF by sending a batman-adv unicast packet with a VLAN-tagged embedded Ethernet header to a victim node; packet fields are attacker-controlled and can force batadv_get_vid()'s pskb_may_pull() to reallocate the skb buffer.
PR:N - No privileges are required on the victim host; exploitation only needs batman-adv active on an interface while the attacker acts as an unauthenticated mesh peer able to transmit batman-adv protocol frames to the target node.
UI:N - No victim user interaction is needed; the kernel automatically processes the malicious batman-adv unicast packet on receive through the normal mesh routing receive path.
S:U - The use-after-free corrupts kernel heap memory within the same host networking subsystem and does not cross VM, container, or IOMMU boundaries to impact a separate security authority.
C:H - The stale unicast_packet pointer dereferences freed skb buffer memory for reads (unicast_packet->dest, unicast_packet->ttvn), constituting a kernel heap use-after-free that can disclose sensitive memory contents.
I:H - The stale pointer is used for writes via ether_addr_copy(unicast_packet->dest) and unicast_packet->ttvn updates in reroute paths, enabling heap corruption and potential arbitrary kernel code execution.
A:H - Use-after-free on the skb data buffer during batman-adv unicast processing can cause kernel oops, panic, or hang, and UAF heap corruption inherently threatens system availability even before full exploit development.
| Attack Vector |
Network |
Scope |
Unchanged |
| Attack Complexity |
Low |
Confidentiality Impact |
High |
| Privileges Required |
None |
Integrity Impact |
High |
| User Interaction |
None |
Availability Impact |
High |
AV:N - Triggered in batadv_check_unicast_ttvn() when batadv_batman_skb_recv() processes incoming BATADV unicast packets from remote mesh peers on hard interfaces; crafted batman-adv frames reach the vulnerable code over the mesh network without local system access.
AC:L - An attacker reliably triggers the UAF by sending a batman-adv unicast packet with a VLAN-tagged embedded Ethernet header to a victim node; packet fields are attacker-controlled and can force batadv_get_vid()'s pskb_may_pull() to reallocate the skb buffer.
PR:N - No privileges are required on the victim host; exploitation only needs batman-adv active on an interface while the attacker acts as an unauthenticated mesh peer able to transmit batman-adv protocol frames to the target node.
UI:N - No victim user interaction is needed; the kernel automatically processes the malicious batman-adv unicast packet on receive through the normal mesh routing receive path.
S:U - The use-after-free corrupts kernel heap memory within the same host networking subsystem and does not cross VM, container, or IOMMU boundaries to impact a separate security authority.
C:H - The stale unicast_packet pointer dereferences freed skb buffer memory for reads (unicast_packet->dest, unicast_packet->ttvn), constituting a kernel heap use-after-free that can disclose sensitive memory contents.
I:H - The stale pointer is used for writes via ether_addr_copy(unicast_packet->dest) and unicast_packet->ttvn updates in reroute paths, enabling heap corruption and potential arbitrary kernel code execution.
A:H - Use-after-free on the skb data buffer during batman-adv unicast processing can cause kernel oops, panic, or hang, and UAF heap corruption inherently threatens system availability even before full exploit development.
CVSS 3.1