In the Linux kernel, the following vulnerability has been resolved:
netfilter: flowtable: Validate iph->ihl in nf_flow_ip4_tunnel_proto()
Add sanity check for iph->ihl field in nf_flow_ip4_tunnel_proto() before
using it to compute the header size, avoiding out-of-bounds access with
malformed IP headers.
While at it, use iph->protocol instead of the hardcoded IPPROTO_IPIP
constant when setting ctx->tun.proto and reference ctx->tun.hdr_size
when updating ctx->offset.
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 9.8
AV:N - The flaw is hit in nf_flow_offload_ip_hook on NF_NETDEV_INGRESS for IPv4 packets arriving on nftables flowtable devices; a remote attacker can send crafted malformed IP/IPIP headers to that interface without any local access on the victim.
AC:L - Once a flowtable ingress hook exists, the attacker fully controls packet headers and can reliably reach nf_flow_ip4_tunnel_proto() by sending IP traffic with an invalid ihl field; no race or victim-specific state beyond admin-enabled flow offload is required.
PR:N - Exploitation requires no credentials or capabilities on the victim host—only that an administrator previously configured nftables flow offload on an ingress device; any remote sender can deliver the malformed packets to trigger parsing on the fast path.
UI:N - No victim interaction is needed; malicious packets are processed automatically by the netdev ingress netfilter hook during normal receive/forward softirq handling on the configured interface.
S:U - Impact is kernel memory corruption and crashes within the host kernel security boundary; this is standard in-kernel compromise territory, not a VM escape, IOMMU bypass, or other cross-authority scope change.
C:H - Missing ihl validation lets iph->ihl<<2 compute an incorrect header size and ctx->offset, causing out-of-bounds skb reads in subsequent tuple parsing and forwarding; per kernel guidance, OOB reads warrant High confidentiality impact.
I:H - Incorrect ctx->offset propagates into nf_flow_tuple_ip() and nf_flow_offload_forward(), which invoke skb_ensure_writable() and perform in-place NAT/header mutation at attacker-influenced offsets—memory corruption exploitable for write primitives warrants High integrity impact.
A:H - Out-of-bounds access in softirq packet processing on the flowtable fast path can trigger KASAN reports, kernel oops, or panics when malformed headers are processed, constituting High availability impact.
| Attack Vector |
Network |
Scope |
Unchanged |
| Attack Complexity |
Low |
Confidentiality Impact |
High |
| Privileges Required |
None |
Integrity Impact |
High |
| User Interaction |
None |
Availability Impact |
High |
AV:N - The flaw is hit in nf_flow_offload_ip_hook on NF_NETDEV_INGRESS for IPv4 packets arriving on nftables flowtable devices; a remote attacker can send crafted malformed IP/IPIP headers to that interface without any local access on the victim.
AC:L - Once a flowtable ingress hook exists, the attacker fully controls packet headers and can reliably reach nf_flow_ip4_tunnel_proto() by sending IP traffic with an invalid ihl field; no race or victim-specific state beyond admin-enabled flow offload is required.
PR:N - Exploitation requires no credentials or capabilities on the victim host—only that an administrator previously configured nftables flow offload on an ingress device; any remote sender can deliver the malformed packets to trigger parsing on the fast path.
UI:N - No victim interaction is needed; malicious packets are processed automatically by the netdev ingress netfilter hook during normal receive/forward softirq handling on the configured interface.
S:U - Impact is kernel memory corruption and crashes within the host kernel security boundary; this is standard in-kernel compromise territory, not a VM escape, IOMMU bypass, or other cross-authority scope change.
C:H - Missing ihl validation lets iph->ihl<<2 compute an incorrect header size and ctx->offset, causing out-of-bounds skb reads in subsequent tuple parsing and forwarding; per kernel guidance, OOB reads warrant High confidentiality impact.
I:H - Incorrect ctx->offset propagates into nf_flow_tuple_ip() and nf_flow_offload_forward(), which invoke skb_ensure_writable() and perform in-place NAT/header mutation at attacker-influenced offsets—memory corruption exploitable for write primitives warrants High integrity impact.
A:H - Out-of-bounds access in softirq packet processing on the flowtable fast path can trigger KASAN reports, kernel oops, or panics when malformed headers are processed, constituting High availability impact.
CVSS 3.1