Linux kernel (net/xfrm): A qdisc that reuses skb

Impact

A qdisc that reuses skb->cb during enqueue clobbers the state decode_session6 relies on, so transmitting IPv6 through an xfrm interface reads freed slab memory while deciding which policy and SA the packet belongs to. Memory-safety break in the path that classifies traffic for encryption.

Who can reach it

Requires an xfrm interface with a cb-clobbering qdisc such as sfb attached, then any IPv6 transmit through it - neighbour discovery traffic is enough. A container with CAP_NET_ADMIN in its own netns can attach the qdisc itself and then send; otherwise it depends on the node's qdisc configuration on the encrypted overlay device.

What to do

Boot a kernel carrying the linked stable commits. Interim: do not attach sfb (or other cb-using qdiscs) to xfrm interfaces, and drop CAP_NET_ADMIN from tenant containers so they cannot attach one.

References