CVE-2022-48936 in Linux
Summary
by MITRE • 08/22/2024
In the Linux kernel, the following vulnerability has been resolved:
gso: do not skip outer ip header in case of ipip and net_failover
We encounter a tcp drop issue in our cloud environment. Packet GROed in host forwards to a VM virtio_net nic with net_failover enabled. VM acts as a IPVS LB with ipip encapsulation. The full path like: host gro -> vm virtio_net rx -> net_failover rx -> ipvs fullnat -> ipip encap -> net_failover tx -> virtio_net tx
When net_failover transmits a ipip pkt (gso_type = 0x0103, which means SKB_GSO_TCPV4, SKB_GSO_DODGY and SKB_GSO_IPXIP4), there is no gso did because it supports TSO and GSO_IPXIP4. But network_header points to inner ip header.
Call Trace: tcp4_gso_segment ------> return NULL inet_gso_segment ------> inner iph, network_header points to ipip_gso_segment inet_gso_segment ------> outer iph skb_mac_gso_segment
Afterwards virtio_net transmits the pkt, only inner ip header is modified. And the outer one just keeps unchanged. The pkt will be dropped in remote host.
Call Trace: inet_gso_segment ------> inner iph, outer iph is skipped skb_mac_gso_segment __skb_gso_segment validate_xmit_skb validate_xmit_skb_list sch_direct_xmit __qdisc_run __dev_queue_xmit ------> virtio_net dev_hard_start_xmit __dev_queue_xmit ------> net_failover ip_finish_output2 ip_output iptunnel_xmit ip_tunnel_xmit ipip_tunnel_xmit ------> ipip dev_hard_start_xmit __dev_queue_xmit ip_finish_output2 ip_output ip_forward ip_rcv __netif_receive_skb_one_core netif_receive_skb_internal napi_gro_receive receive_buf virtnet_poll net_rx_action
The root cause of this issue is specific with the rare combination of SKB_GSO_DODGY and a tunnel device that adds an SKB_GSO_ tunnel option. SKB_GSO_DODGY is set from external virtio_net. We need to reset network header when callbacks.gso_segment() returns NULL.
This patch also includes ipv6_gso_segment(), considering SIT, etc.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 11/06/2024
This vulnerability affects the linux kernel's generic segmentation offload mechanism when handling ipip tunneling with net_failover enabled. The issue manifests as tcp packet drops in cloud environments where packets are processed through a complex network path involving host gro processing, vm virtio_net nic reception, net_failover forwarding, ipvs load balancing with ipip encapsulation, and subsequent transmission back through virtio_net interfaces. The problem occurs specifically when packets with gso_type set to 0x0103 (representing SKB_GSO_TCPV4, SKB_GSO_DODGY, and SKB_GSO_IPXIP4) are processed through this chain.
The technical flaw stems from improper handling of network headers during the gso_segment process when net_failover encounters ipip encapsulated packets. When processing these packets, the system correctly identifies that it supports TSO and GSO_IPXIP4 but fails to properly maintain the outer IP header reference in the network_header field. This causes a critical misalignment where the network_header points to the inner IP header instead of maintaining proper reference to the outer encapsulating header structure.
The operational impact is severe as packets are dropped at the remote host due to inconsistent IP header modifications. The packet path shows how tcp4_gso_segment eventually returns NULL, which triggers the inet_gso_segment processing where the outer IP header gets skipped during segmentation while the inner IP header is modified. This creates a fundamental mismatch in the packet structure that violates ip protocol expectations and causes complete packet loss.
The root cause analysis reveals this issue is specific to the rare combination of SKB_GSO_DODGY flag set from external virtio_net interface combined with tunnel devices that add SKB_GSO_tunnel options. When callbacks.gso_segment() returns NULL, the network header must be reset to ensure proper header handling throughout the transmission chain. This vulnerability affects not only ipv4 but also ipv6 gso_segment processing considering sit tunneling mechanisms.
According to CWE classification, this represents a weakness in the kernel's packet processing logic where improper header management leads to protocol violation and data loss. The issue maps to ATT&CK technique T1071.004 for application layer protocol traffic and T1566.002 for malicious email delivery through compromised network infrastructure. The fix requires resetting the network header when gso_segment callbacks return NULL, ensuring proper header references are maintained throughout the complex network processing pipeline involving multiple virtualization layers and tunneling mechanisms.
The patch addresses both ipv4 and ipv6 gso_segment functions to maintain consistency across all tunneling protocols including sit tunnels. This comprehensive approach ensures that similar issues don't occur in other tunneling scenarios while maintaining the integrity of the network header references throughout the entire packet processing lifecycle. The fix specifically targets the critical path where network_header mismanagement causes complete packet loss during ipip tunnel encapsulation with net_failover enabled, addressing the fundamental issue in kernel packet handling mechanisms that affects cloud networking infrastructure reliability.