Linux kernel (net/xfrm): Outbound policies rejected optional tunnel and BEET templates but never got the same check for

Impact

Outbound policies rejected optional tunnel and BEET templates but never got the same check for IPTFS, so an IPTFS template marked 'level use' walks past the end of the template address array during outbound resolution. The result is a stack out-of-bounds read used to pick a security association - kernel stack contents leaked into SA selection, and a crash when the read lands badly. A tenant able to install policies gets both an information-disclosure primitive and a node crash.

Who can reach it

Two commands and a ping, per the upstream reproducer: install an outbound policy whose first template is 'mode iptfs level use', then send any packet matching the selector. That needs the ability to write xfrm policy - host root, or a tenant container holding CAP_NET_ADMIN in its own user+network namespace. Inbound and forward policies are unaffected. Conditional on IPTFS support being present in the kernel.

What to do

Boot a kernel carrying the fix commits below (no fixed stable version published). Interim control: do not grant CAP_NET_ADMIN inside tenant user namespaces; if tenants must program IPsec, reject templates with mode iptfs and level use in whatever admission layer sits in front of the xfrm netlink socket.

References