CVE-2022-48687

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ipv6: sr: fix out-of-bounds read when setting HMAC data.

The SRv6 layer allows defining HMAC data that can later be used to sign IPv6

Segment Routing Headers. This configuration is realised via netlink through

four attributes: SEG6_ATTR_HMACKEYID, SEG6_ATTR_SECRET, SEG6_ATTR_SECRETLEN and

SEG6_ATTR_ALGID. Because the SECRETLEN attribute is decoupled from the actual

length of the SECRET attribute, it is possible to provide invalid combinations

(e.g., secret = "", secretlen = 64). This case is not checked in the code and

with an appropriately crafted netlink message, an out-of-bounds read of up

to 64 bytes (max secret length) can occur past the skb end pointer and into

skb_shared_info:

Breakpoint 1, seg6_genl_sethmac (skb=<optimized out>, info=<optimized out>) at net/ipv6/seg6.c:208

208 memcpy(hinfo->secret, secret, slen);

(gdb) bt

#0 seg6_genl_sethmac (skb=<optimized out>, info=<optimized out>) at net/ipv6/seg6.c:

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References