In the Linux kernel, the following vulnerability has been resolved:
ipvs: ensure inner headers in ICMP errors are in headroom
Sashiko points out that after stripping the outer headers
with pskb_pull() we should ensure the inner IP headers
in ICMP errors from tunnels are present in the skb headroom
for functions like ipv4_update_pmtu(), icmp_send() and
IP_VS_DBG().
Also, add more checks for the length of the inner headers.
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 9.8
AV:N - Crafted IPv4 ICMP error packets reach ip_vs_in_icmp() through IPVS netfilter LOCAL_IN and FORWARD hooks on internet-facing load balancers and Kubernetes kube-proxy IPVS nodes; remote senders trigger the tunnel PMTUD handler without local access.
AC:L - An attacker controls ICMP nesting, IPIP/UDP/GRE encapsulation, skb fragmentation/non-linear layout, and can establish matching IPVS TUN connections through the VIP; no race or condition outside attacker control is required once IPVS tunnel mode is deployed.
PR:N - IPVS configuration is an administrator deployment prerequisite; a remote attacker sending ICMP errors to an already-configured load balancer needs no credentials or host capabilities on the victim.
UI:N - Exploitation is driven entirely by network packets processed automatically in softirq; no victim user action beyond normal traffic through the load balancer is required.
S:U - Out-of-bounds kernel skb header access and route PMTU corruption remain within the host kernel authority; this is standard kernel compromise, not VM escape or sandbox crossing.
C:H - After pskb_pull() without pskb_may_pull(), ipv4_update_pmtu() and ip_hdr() dereference skb->data that may lie past skb_tail_pointer or hold non-linear fragment data, constituting an out-of-bounds kernel read per CNA guidance.
I:H - Mis-parsed inner IP header fields from unchecked skb->data drive ipv4_update_pmtu() route lookups and FNHE/PMTU updates with attacker-influenced saddr/daddr values, enabling unauthorized modification of kernel routing state.
A:H - Out-of-bounds header access in the IPVS ICMP tunnel path can trigger kernel oops or panic, and a remote attacker can repeatedly send crafted ICMP errors to deny service on IPVS TUN load balancers.
| Attack Vector |
Network |
Scope |
Unchanged |
| Attack Complexity |
Low |
Confidentiality Impact |
High |
| Privileges Required |
None |
Integrity Impact |
High |
| User Interaction |
None |
Availability Impact |
High |
AV:N - Crafted IPv4 ICMP error packets reach ip_vs_in_icmp() through IPVS netfilter LOCAL_IN and FORWARD hooks on internet-facing load balancers and Kubernetes kube-proxy IPVS nodes; remote senders trigger the tunnel PMTUD handler without local access.
AC:L - An attacker controls ICMP nesting, IPIP/UDP/GRE encapsulation, skb fragmentation/non-linear layout, and can establish matching IPVS TUN connections through the VIP; no race or condition outside attacker control is required once IPVS tunnel mode is deployed.
PR:N - IPVS configuration is an administrator deployment prerequisite; a remote attacker sending ICMP errors to an already-configured load balancer needs no credentials or host capabilities on the victim.
UI:N - Exploitation is driven entirely by network packets processed automatically in softirq; no victim user action beyond normal traffic through the load balancer is required.
S:U - Out-of-bounds kernel skb header access and route PMTU corruption remain within the host kernel authority; this is standard kernel compromise, not VM escape or sandbox crossing.
C:H - After pskb_pull() without pskb_may_pull(), ipv4_update_pmtu() and ip_hdr() dereference skb->data that may lie past skb_tail_pointer or hold non-linear fragment data, constituting an out-of-bounds kernel read per CNA guidance.
I:H - Mis-parsed inner IP header fields from unchecked skb->data drive ipv4_update_pmtu() route lookups and FNHE/PMTU updates with attacker-influenced saddr/daddr values, enabling unauthorized modification of kernel routing state.
A:H - Out-of-bounds header access in the IPVS ICMP tunnel path can trigger kernel oops or panic, and a remote attacker can repeatedly send crafted ICMP errors to deny service on IPVS TUN load balancers.
CVSS 3.1