CVE-2023-3090

Una vulnerabilidad de escritura fuera de los límites de la memoria en el controlador de red ipvlan del kernel de Linux se puede explotar para lograr la escalada de privilegios locales. La escritura fuera de los límites se debe a la falta de inicialización skb->cb en el controlador de red ipvlan. La vulnerabilidad es accesible si CONFIG_IPVLAN está habilitada. Recomendamos actualizar al anterior commit 90cbed5247439a966b645b34eb0a2e037836ea8e.

A flaw was found in the IPVLAN network driver in the Linux kernel. This issue is caused by missing skb->cb initialization in `__ip_options_echo` and can lead to an out-of-bounds write stack overflow. This may allow a local user to cause a denial of service or potentially achieve local privilege escalation.

A heap out-of-bounds write vulnerability in the Linux Kernel ipvlan network driver can be exploited to achieve local privilege escalation. The out-of-bounds write is caused by missing skb->cb initialization in the ipvlan network driver. The vulnerability is reachable if CONFIG_IPVLAN is enabled. We recommend upgrading past commit 90cbed5247439a966b645b34eb0a2e037836ea8e.

This update for the Linux Kernel 5.14.21-150400_24_46 fixes several issues. The following security issues were fixed. Fixed a use-after-free in Netfilter nf_tables when processing batch requests. Fixed a flaw in the networking subsystem within the handling of the RPL protocol. Fixed a use-after-free in vcs_read in drivers/tty/vt/vc_screen.c. Fixed an out-of-bounds memory access flaw in nft_byteorder that could allow a local attacker to escalate their privilege. Fixed a type confusion in pick_next_rt_entity, that could cause memory corruption. Fixed an out-of-boundary read in compare_netdev_and_ip in drivers/infiniband/core/cma.c in RDMA. Fixed a heap out-of-bounds write in the ipvlan network driver.