In the Linux kernel, the following vulnerability has been resolved:
net: ife: require ETH_HLEN to be pullable in ife_decode()
ife decode may return after making only the outer IFE header and
metadata pullable. The caller then passes the decapsulated packet to
eth_type_trans(), which expects the inner Ethernet header to be
accessible from the linear data area.
With a malformed IFE frame, the inner Ethernet header may still be
shorter than ETH_HLEN in the linear area, which can lead to a crash in
the original code.
Fix this by extending the pull check in ife_decode() so that the inner
Ethernet header is also guaranteed to be pullable before returning.
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
CVSS Score: 9.1
AV:N - The flaw is hit on the ingress packet receive path (__netif_receive_skb_core→sch_handle_ingress→tc_run→tcf_ife_act→ife_decode) when a remote peer sends a malformed IFE-encapsulated Ethernet frame to a netdev with clsact/ingress IFE decode, as in SDN/NFV/ForCES edge nodes.
AC:L - Once ingress IFE decode is present, the attacker fully controls the crafted frame (metalen, metadata size, and skb layout) to leave the inner Ethernet header non-linear or shorter than ETH_HLEN, deterministically reaching eth_type_trans() without races or uncontrollable memory layout.
PR:N - Remote exploitation needs no credentials or capabilities on the victim—only delivery of a malformed frame to an interface already configured with IFE decode; CAP_NET_ADMIN is an operator deployment prerequisite, not attacker privilege (same model as pre-configured nftables offload bugs).
UI:N - No victim user action is required beyond normal network delivery of attacker-crafted IFE traffic; exploitation does not depend on mounting, opening files, or administrator interaction at attack time.
S:U - Impact is confined to kernel packet-processing memory within the same kernel security authority; this is not a VM escape, IOMMU bypass, or cross-namespace scope change.
C:H - eth_type_trans() reads the inner struct ethhdr (h_dest/h_proto) via eth_skb_pull_mac()/eth_skb_pkt_type() without ensuring ETH_HLEN bytes are linear, causing an out-of-bounds kernel read that can disclose adjacent skb/page memory beyond a few bytes.
I:N - The defect is a missing pskb_may_pull() bounds check leading to out-of-bounds reads and crash; there is no write, UAF, or demonstrated arbitrary modification or control-flow hijack primitive.
A:H - The fix commit states malformed IFE frames can crash the kernel; accessing a non-linear or undersized inner Ethernet header in eth_type_trans() can trigger KASAN faults, oops, or panic on the softirq receive path.
| Attack Vector |
Network |
Scope |
Unchanged |
| Attack Complexity |
Low |
Confidentiality Impact |
High |
| Privileges Required |
None |
Integrity Impact |
None |
| User Interaction |
None |
Availability Impact |
High |
AV:N - The flaw is hit on the ingress packet receive path (__netif_receive_skb_core→sch_handle_ingress→tc_run→tcf_ife_act→ife_decode) when a remote peer sends a malformed IFE-encapsulated Ethernet frame to a netdev with clsact/ingress IFE decode, as in SDN/NFV/ForCES edge nodes.
AC:L - Once ingress IFE decode is present, the attacker fully controls the crafted frame (metalen, metadata size, and skb layout) to leave the inner Ethernet header non-linear or shorter than ETH_HLEN, deterministically reaching eth_type_trans() without races or uncontrollable memory layout.
PR:N - Remote exploitation needs no credentials or capabilities on the victim—only delivery of a malformed frame to an interface already configured with IFE decode; CAP_NET_ADMIN is an operator deployment prerequisite, not attacker privilege (same model as pre-configured nftables offload bugs).
UI:N - No victim user action is required beyond normal network delivery of attacker-crafted IFE traffic; exploitation does not depend on mounting, opening files, or administrator interaction at attack time.
S:U - Impact is confined to kernel packet-processing memory within the same kernel security authority; this is not a VM escape, IOMMU bypass, or cross-namespace scope change.
C:H - eth_type_trans() reads the inner struct ethhdr (h_dest/h_proto) via eth_skb_pull_mac()/eth_skb_pkt_type() without ensuring ETH_HLEN bytes are linear, causing an out-of-bounds kernel read that can disclose adjacent skb/page memory beyond a few bytes.
I:N - The defect is a missing pskb_may_pull() bounds check leading to out-of-bounds reads and crash; there is no write, UAF, or demonstrated arbitrary modification or control-flow hijack primitive.
A:H - The fix commit states malformed IFE frames can crash the kernel; accessing a non-linear or undersized inner Ethernet header in eth_type_trans() can trigger KASAN faults, oops, or panic on the softirq receive path.
CVSS 3.1