In the Linux kernel, the following vulnerability has been resolved:
tun: add missing verification for short frame
The cited commit missed to check against the validity of the frame length in the tunxdpone() path, which could cause a corrupted skb to be sent downstack. Even before the skb is transmitted, the tunxdpone-->ethtypetrans() may access the Ethernet header although it can be less than ETH_HLEN. Once transmitted, this could either cause out-of-bound access beyond the actual length, or confuse the underlayer with incorrect or inconsistent header length in the skb metadata.
In the alternative path, tungetuser() already prohibits short frame which has the length less than Ethernet header size from being transmitted for IFF_TAP.
This is to drop any frame shorter than the Ethernet header size just like how tungetuser() does.
CVE: CVE-2024-41091
{ "vanir_signatures": [ { "signature_version": "v1", "signature_type": "Function", "target": { "file": "drivers/net/tun.c", "function": "tun_xdp_one" }, "deprecated": false, "digest": { "length": 2123.0, "function_hash": "322623148800577962048690861134988645569" }, "id": "CVE-2024-41091-0abbe638", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ad6b3f622ccfb4bfedfa53b6ebd91c3d1d04f146" }, { "signature_version": "v1", "signature_type": "Function", "target": { "file": "drivers/net/tun.c", "function": "tun_xdp_one" }, "deprecated": false, "digest": { "length": 1985.0, "function_hash": "88168202664557663917896732640241350923" }, "id": "CVE-2024-41091-1468a8a5", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6100e0237204890269e3f934acfc50d35fd6f319" }, { "signature_version": "v1", "signature_type": "Function", "target": { "file": "drivers/net/tun.c", "function": "tun_xdp_one" }, "deprecated": false, "digest": { "length": 1919.0, "function_hash": "270009156057391000759496269319814986306" }, "id": "CVE-2024-41091-1a2975df", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@32b0aaba5dbc85816898167d9b5d45a22eae82e9" }, { "signature_version": "v1", "signature_type": "Line", "target": { "file": "drivers/net/tun.c" }, "deprecated": false, "digest": { "line_hashes": [ "55197356253009846171804845152289035417", "72336339919822964427691204484274055610", "244552263367327482913434795149226830669" ], "threshold": 0.9 }, "id": "CVE-2024-41091-1ab9f92d", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@32b0aaba5dbc85816898167d9b5d45a22eae82e9" }, { "signature_version": "v1", "signature_type": "Function", "target": { "file": "drivers/net/tun.c", "function": "tun_xdp_one" }, "deprecated": false, "digest": { "length": 2125.0, "function_hash": "234458736199485920790827825095995599288" }, "id": "CVE-2024-41091-310852dd", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@049584807f1d797fc3078b68035450a9769eb5c3" }, { "signature_version": "v1", "signature_type": "Line", "target": { "file": "drivers/net/tun.c" }, "deprecated": false, "digest": { "line_hashes": [ "314340516724240722025145189580690398040", "72336339919822964427691204484274055610", "244552263367327482913434795149226830669" ], "threshold": 0.9 }, "id": "CVE-2024-41091-53a39d9d", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a9d1c27e2ee3b0ea5d40c105d6e728fc114470bb" }, { "signature_version": "v1", "signature_type": "Line", "target": { "file": "drivers/net/tun.c" }, "deprecated": false, "digest": { "line_hashes": [ "55197356253009846171804845152289035417", "72336339919822964427691204484274055610", "244552263367327482913434795149226830669" ], "threshold": 0.9 }, "id": "CVE-2024-41091-58e3bc1d", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@589382f50b4a5d90d16d8bc9dcbc0e927a3e39b2" }, { "signature_version": "v1", "signature_type": "Line", "target": { "file": "drivers/net/tun.c" }, "deprecated": false, "digest": { "line_hashes": [ "314340516724240722025145189580690398040", "72336339919822964427691204484274055610", "244552263367327482913434795149226830669" ], "threshold": 0.9 }, "id": "CVE-2024-41091-66540371", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d5ad89b7d01ed4e66fd04734fc63d6e78536692a" }, { "signature_version": "v1", "signature_type": "Function", "target": { "file": "drivers/net/tun.c", "function": "tun_xdp_one" }, "deprecated": false, "digest": { "length": 1804.0, "function_hash": "118681498002110687243544001134969489987" }, "id": "CVE-2024-41091-72b3e35f", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@589382f50b4a5d90d16d8bc9dcbc0e927a3e39b2" }, { "signature_version": "v1", "signature_type": "Function", "target": { "file": "drivers/net/tun.c", "function": "tun_xdp_one" }, "deprecated": false, "digest": { "length": 2123.0, "function_hash": "322623148800577962048690861134988645569" }, "id": "CVE-2024-41091-ad3de602", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d5ad89b7d01ed4e66fd04734fc63d6e78536692a" }, { "signature_version": "v1", "signature_type": "Function", "target": { "file": "drivers/net/tun.c", "function": "tun_xdp_one" }, "deprecated": false, "digest": { "length": 2125.0, "function_hash": "234458736199485920790827825095995599288" }, "id": "CVE-2024-41091-b3a99c5f", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a9d1c27e2ee3b0ea5d40c105d6e728fc114470bb" }, { "signature_version": "v1", "signature_type": "Line", "target": { "file": "drivers/net/tun.c" }, "deprecated": false, "digest": { "line_hashes": [ "314340516724240722025145189580690398040", "72336339919822964427691204484274055610", "244552263367327482913434795149226830669" ], "threshold": 0.9 }, "id": "CVE-2024-41091-b4013dc2", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8418f55302fa1d2eeb73e16e345167e545c598a5" }, { "signature_version": "v1", "signature_type": "Function", "target": { "file": "drivers/net/tun.c", "function": "tun_xdp_one" }, "deprecated": false, "digest": { "length": 2125.0, "function_hash": "234458736199485920790827825095995599288" }, "id": "CVE-2024-41091-b7bf4bdd", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8418f55302fa1d2eeb73e16e345167e545c598a5" }, { "signature_version": "v1", "signature_type": "Line", "target": { "file": "drivers/net/tun.c" }, "deprecated": false, "digest": { "line_hashes": [ "314340516724240722025145189580690398040", "72336339919822964427691204484274055610", "244552263367327482913434795149226830669" ], "threshold": 0.9 }, "id": "CVE-2024-41091-c6e8e93c", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ad6b3f622ccfb4bfedfa53b6ebd91c3d1d04f146" }, { "signature_version": "v1", "signature_type": "Line", "target": { "file": "drivers/net/tun.c" }, "deprecated": false, "digest": { "line_hashes": [ "55197356253009846171804845152289035417", "72336339919822964427691204484274055610", "244552263367327482913434795149226830669" ], "threshold": 0.9 }, "id": "CVE-2024-41091-dbb7d670", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6100e0237204890269e3f934acfc50d35fd6f319" }, { "signature_version": "v1", "signature_type": "Line", "target": { "file": "drivers/net/tun.c" }, "deprecated": false, "digest": { "line_hashes": [ "314340516724240722025145189580690398040", "72336339919822964427691204484274055610", "244552263367327482913434795149226830669" ], "threshold": 0.9 }, "id": "CVE-2024-41091-fb5f4b9b", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@049584807f1d797fc3078b68035450a9769eb5c3" } ] }