In the Linux kernel, the following vulnerability has been resolved:
xfrm6: fix out-of-bounds write in xfrm6_input_addr() when secpath is full
The depth check in xfrm6_input_addr() is off by one:
if (1 + sp->len == XFRM_MAX_DEPTH)
goto drop;
...
sp->xvec[sp->len++] = x;
xfrm_input() can leave sp->len == XFRM_MAX_DEPTH, and the transport-mode
receive path re-enters IPv6 input via xfrm_trans_reinject() with that
secpath preserved. If the inner packet carries a destination-options HAO
option or a type-2 routing header, xfrm6_input_addr() is called with
sp->len == XFRM_MAX_DEPTH; the check (1 + 6 == 6) is false, so
sp->xvec[sp->len++] writes one slot past the 6-element xvec[]. The write
stays within the sec_path allocation (invisible to KASAN); UBSAN_BOUNDS
flags it and panics under panic_on_warn.
Use "sp->len >= XFRM_MAX_DEPTH", matching xfrm_input(). This also
restores one chain level the old check rejected at sp->len == 5.
UBSAN: array-index-out-of-bounds in net/ipv6/xfrm6_input.c:309:10
index 6 is out of range for type 'xfrm_state *[6]'
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 9.8
AV:N - The bug is on the IPv6 receive path: remote ESP/AH packets are processed by xfrm_input() until the secpath is full, then xfrm_trans_reinject() re-enters ip6_rcv_finish so an inner destopt HAO or type-2 routing header reaches xfrm6_input_addr() on internet-facing IPsec/MIP6 VPN and home-agent endpoints.
AC:L - Once a max-depth transport-mode IPsec bundle and a MIP6 destopt or routing state are present, a peer sending nested IPsec then an inner HAO or type-2 RH deterministically bypasses the off-by-one check (1+6!=6) and writes xvec[6]; no race or attacker-uncontrollable layout is required.
PR:N - No local account or capability on the victim is required. A remote IPsec/MIP6 peer triggers the overflow with packets accepted by already-installed SAs; creating those SAs is a deployment precondition rather than attacker privilege on the host.
UI:N - Packets are processed in NAPI/softirq and the deferred xfrm_trans_reinject workqueue with no victim action such as mounting a filesystem, opening a file, or otherwise interacting with the host.
S:U - The out-of-bounds write corrupts the skb sec_path in the host kernel that processed the packet; this is standard kernel memory corruption, not a VM escape, IOMMU bypass, or other cross-authority boundary.
C:H - The overflow writes a kernel xfrm_state pointer past xvec[] into the adjacent xfrm_offload object and sets len to 7, so later xvec walks and teardown treat that overlapping memory as a state pointer, giving a memory-corruption disclosure primitive.
I:H - This is an out-of-bounds write of a kernel pointer one slot past the 6-element xvec[] into ovec, which per kernel CVSS guidance is high integrity impact and can be shaped toward control-flow hijacking.
A:H - UBSAN_BOUNDS flags the overflow and panics under panic_on_warn, and the corrupted sec_path (len=7 overlapping ovec) can oops during later xvec iteration or skb_ext teardown, fully denying availability.
| Attack Vector |
Network |
Scope |
Unchanged |
| Attack Complexity |
Low |
Confidentiality Impact |
High |
| Privileges Required |
None |
Integrity Impact |
High |
| User Interaction |
None |
Availability Impact |
High |
AV:N - The bug is on the IPv6 receive path: remote ESP/AH packets are processed by xfrm_input() until the secpath is full, then xfrm_trans_reinject() re-enters ip6_rcv_finish so an inner destopt HAO or type-2 routing header reaches xfrm6_input_addr() on internet-facing IPsec/MIP6 VPN and home-agent endpoints.
AC:L - Once a max-depth transport-mode IPsec bundle and a MIP6 destopt or routing state are present, a peer sending nested IPsec then an inner HAO or type-2 RH deterministically bypasses the off-by-one check (1+6!=6) and writes xvec[6]; no race or attacker-uncontrollable layout is required.
PR:N - No local account or capability on the victim is required. A remote IPsec/MIP6 peer triggers the overflow with packets accepted by already-installed SAs; creating those SAs is a deployment precondition rather than attacker privilege on the host.
UI:N - Packets are processed in NAPI/softirq and the deferred xfrm_trans_reinject workqueue with no victim action such as mounting a filesystem, opening a file, or otherwise interacting with the host.
S:U - The out-of-bounds write corrupts the skb sec_path in the host kernel that processed the packet; this is standard kernel memory corruption, not a VM escape, IOMMU bypass, or other cross-authority boundary.
C:H - The overflow writes a kernel xfrm_state pointer past xvec[] into the adjacent xfrm_offload object and sets len to 7, so later xvec walks and teardown treat that overlapping memory as a state pointer, giving a memory-corruption disclosure primitive.
I:H - This is an out-of-bounds write of a kernel pointer one slot past the 6-element xvec[] into ovec, which per kernel CVSS guidance is high integrity impact and can be shaped toward control-flow hijacking.
A:H - UBSAN_BOUNDS flags the overflow and panics under panic_on_warn, and the corrupted sec_path (len=7 overlapping ovec) can oops during later xvec iteration or skb_ext teardown, fully denying availability.
CVSS 3.1