In the Linux kernel, the following vulnerability has been resolved: bpf: Scrub packet on bpfredirectpeer When bpfredirectpeer is used to redirect packets to a device in another network namespace, the skb isn't scrubbed. That can lead skb information from one namespace to be "misused" in another namespace. As one example, this is causing Cilium to drop traffic when using bpfredirectpeer to redirect packets that just went through IPsec decryption to a container namespace. The following pwru trace shows (1) the packet path from the host's XFRM layer to the container's XFRM layer where it's dropped and (2) the number of active skb extensions at each function. NETNS MARK IFACE TUPLE FUNC 4026533547 d00 eth0 10.244.3.124:35473->10.244.2.158:53 xfrmrcvcb .activeextensions = (u8)2, 4026533547 d00 eth0 10.244.3.124:35473->10.244.2.158:53 xfrm4rcvcb .activeextensions = (u8)2, 4026533547 d00 eth0 10.244.3.124:35473->10.244.2.158:53 grocellsreceive .activeextensions = (u8)2, [...] 4026533547 0 eth0 10.244.3.124:35473->10.244.2.158:53 skbdoredirect .activeextensions = (u8)2, 4026534999 0 eth0 10.244.3.124:35473->10.244.2.158:53 iprcv .activeextensions = (u8)2, 4026534999 0 eth0 10.244.3.124:35473->10.244.2.158:53 iprcvcore .activeextensions = (u8)2, [...] 4026534999 0 eth0 10.244.3.124:35473->10.244.2.158:53 udpqueuercvoneskb .activeextensions = (u8)2, 4026534999 0 eth0 10.244.3.124:35473->10.244.2.158:53 _xfrmpolicycheck .activeextensions = (u8)2, 4026534999 0 eth0 10.244.3.124:35473->10.244.2.158:53 xfrmdecodesession .activeextensions = (u8)2, 4026534999 0 eth0 10.244.3.124:35473->10.244.2.158:53 securityxfrmdecodesession .activeextensions = (u8)2, 4026534999 0 eth0 10.244.3.124:35473->10.244.2.158:53 kfreeskbreason(SKBDROPREASONXFRMPOLICY) .activeextensions = (u8)2, In this case, there are no XFRM policies in the container's network namespace so the drop is unexpected. When we decrypt the IPsec packet, the XFRM state used for decryption is set in the skb extensions. This information is preserved across the netns switch. When we reach the XFRM policy check in the container's netns, _xfrmpolicycheck drops the packet with LINUXMIBXFRMINNOPOLS because a (container-side) XFRM policy can't be found that matches the (host-side) XFRM state used for decryption. This patch fixes this by scrubbing the packet when using bpfredirect_peer, as is done on typical netns switches via veth devices except skb->mark and skb->tstamp are not zeroed.
{ "binaries": [ { "binary_name": "linux-aws-6.14-cloud-tools-6.14.0-1011", "binary_version": "6.14.0-1011.11~24.04.1" }, { "binary_name": "linux-aws-6.14-headers-6.14.0-1011", "binary_version": "6.14.0-1011.11~24.04.1" }, { "binary_name": "linux-aws-6.14-tools-6.14.0-1011", "binary_version": "6.14.0-1011.11~24.04.1" }, { "binary_name": "linux-buildinfo-6.14.0-1011-aws", "binary_version": "6.14.0-1011.11~24.04.1" }, { "binary_name": "linux-buildinfo-6.14.0-1011-aws-64k", "binary_version": "6.14.0-1011.11~24.04.1" }, { "binary_name": "linux-cloud-tools-6.14.0-1011-aws", "binary_version": "6.14.0-1011.11~24.04.1" }, { "binary_name": "linux-cloud-tools-6.14.0-1011-aws-64k", "binary_version": "6.14.0-1011.11~24.04.1" }, { "binary_name": "linux-headers-6.14.0-1011-aws", "binary_version": "6.14.0-1011.11~24.04.1" }, { "binary_name": "linux-headers-6.14.0-1011-aws-64k", "binary_version": "6.14.0-1011.11~24.04.1" }, { "binary_name": "linux-image-unsigned-6.14.0-1011-aws", "binary_version": "6.14.0-1011.11~24.04.1" }, { "binary_name": "linux-image-unsigned-6.14.0-1011-aws-64k", "binary_version": "6.14.0-1011.11~24.04.1" }, { "binary_name": "linux-image-unsigned-6.14.0-1011-aws-64k-dbgsym", "binary_version": "6.14.0-1011.11~24.04.1" }, { "binary_name": "linux-image-unsigned-6.14.0-1011-aws-dbgsym", "binary_version": "6.14.0-1011.11~24.04.1" }, { "binary_name": "linux-modules-6.14.0-1011-aws", "binary_version": "6.14.0-1011.11~24.04.1" }, { "binary_name": "linux-modules-6.14.0-1011-aws-64k", "binary_version": "6.14.0-1011.11~24.04.1" }, { "binary_name": "linux-modules-extra-6.14.0-1011-aws", "binary_version": "6.14.0-1011.11~24.04.1" }, { "binary_name": "linux-modules-extra-6.14.0-1011-aws-64k", "binary_version": "6.14.0-1011.11~24.04.1" }, { "binary_name": "linux-tools-6.14.0-1011-aws", "binary_version": "6.14.0-1011.11~24.04.1" }, { "binary_name": "linux-tools-6.14.0-1011-aws-64k", "binary_version": "6.14.0-1011.11~24.04.1" } ], "availability": "No subscription required" }
{ "binaries": [ { "binary_name": "linux-buildinfo-6.14.0-1014-gcp", "binary_version": "6.14.0-1014.15~24.04.1" }, { "binary_name": "linux-buildinfo-6.14.0-1014-gcp-64k", "binary_version": "6.14.0-1014.15~24.04.1" }, { "binary_name": "linux-gcp-6.14-headers-6.14.0-1014", "binary_version": "6.14.0-1014.15~24.04.1" }, { "binary_name": "linux-gcp-6.14-tools-6.14.0-1014", "binary_version": "6.14.0-1014.15~24.04.1" }, { "binary_name": "linux-headers-6.14.0-1014-gcp", "binary_version": "6.14.0-1014.15~24.04.1" }, { "binary_name": "linux-headers-6.14.0-1014-gcp-64k", "binary_version": "6.14.0-1014.15~24.04.1" }, { "binary_name": "linux-image-unsigned-6.14.0-1014-gcp", "binary_version": "6.14.0-1014.15~24.04.1" }, { "binary_name": "linux-image-unsigned-6.14.0-1014-gcp-64k", "binary_version": "6.14.0-1014.15~24.04.1" }, { "binary_name": "linux-image-unsigned-6.14.0-1014-gcp-64k-dbgsym", "binary_version": "6.14.0-1014.15~24.04.1" }, { "binary_name": "linux-image-unsigned-6.14.0-1014-gcp-dbgsym", "binary_version": "6.14.0-1014.15~24.04.1" }, { "binary_name": "linux-lib-rust-6.14.0-1014-gcp", "binary_version": "6.14.0-1014.15~24.04.1" }, { "binary_name": "linux-modules-6.14.0-1014-gcp", "binary_version": "6.14.0-1014.15~24.04.1" }, { "binary_name": "linux-modules-6.14.0-1014-gcp-64k", "binary_version": "6.14.0-1014.15~24.04.1" }, { "binary_name": "linux-modules-extra-6.14.0-1014-gcp", "binary_version": "6.14.0-1014.15~24.04.1" }, { "binary_name": "linux-modules-extra-6.14.0-1014-gcp-64k", "binary_version": "6.14.0-1014.15~24.04.1" }, { "binary_name": "linux-tools-6.14.0-1014-gcp", "binary_version": "6.14.0-1014.15~24.04.1" }, { "binary_name": "linux-tools-6.14.0-1014-gcp-64k", "binary_version": "6.14.0-1014.15~24.04.1" } ], "availability": "No subscription required" }
{ "binaries": [ { "binary_name": "linux-buildinfo-6.14.0-1011-oracle", "binary_version": "6.14.0-1011.11~24.04.1" }, { "binary_name": "linux-buildinfo-6.14.0-1011-oracle-64k", "binary_version": "6.14.0-1011.11~24.04.1" }, { "binary_name": "linux-headers-6.14.0-1011-oracle", "binary_version": "6.14.0-1011.11~24.04.1" }, { "binary_name": "linux-headers-6.14.0-1011-oracle-64k", "binary_version": "6.14.0-1011.11~24.04.1" }, { "binary_name": "linux-image-unsigned-6.14.0-1011-oracle", "binary_version": "6.14.0-1011.11~24.04.1" }, { "binary_name": "linux-image-unsigned-6.14.0-1011-oracle-64k", "binary_version": "6.14.0-1011.11~24.04.1" }, { "binary_name": "linux-image-unsigned-6.14.0-1011-oracle-64k-dbgsym", "binary_version": "6.14.0-1011.11~24.04.1" }, { "binary_name": "linux-image-unsigned-6.14.0-1011-oracle-dbgsym", "binary_version": "6.14.0-1011.11~24.04.1" }, { "binary_name": "linux-modules-6.14.0-1011-oracle", "binary_version": "6.14.0-1011.11~24.04.1" }, { "binary_name": "linux-modules-6.14.0-1011-oracle-64k", "binary_version": "6.14.0-1011.11~24.04.1" }, { "binary_name": "linux-modules-extra-6.14.0-1011-oracle", "binary_version": "6.14.0-1011.11~24.04.1" }, { "binary_name": "linux-modules-extra-6.14.0-1011-oracle-64k", "binary_version": "6.14.0-1011.11~24.04.1" }, { "binary_name": "linux-oracle-6.14-headers-6.14.0-1011", "binary_version": "6.14.0-1011.11~24.04.1" }, { "binary_name": "linux-oracle-6.14-tools-6.14.0-1011", "binary_version": "6.14.0-1011.11~24.04.1" }, { "binary_name": "linux-tools-6.14.0-1011-oracle", "binary_version": "6.14.0-1011.11~24.04.1" }, { "binary_name": "linux-tools-6.14.0-1011-oracle-64k", "binary_version": "6.14.0-1011.11~24.04.1" } ], "availability": "No subscription required" }
{ "binaries": [ { "binary_name": "linux-buildinfo-6.14.0-28-generic", "binary_version": "6.14.0-28.28.1~24.04.1" }, { "binary_name": "linux-headers-6.14.0-28-generic", "binary_version": "6.14.0-28.28.1~24.04.1" }, { "binary_name": "linux-image-6.14.0-28-generic", "binary_version": "6.14.0-28.28.1~24.04.1" }, { "binary_name": "linux-image-6.14.0-28-generic-dbgsym", "binary_version": "6.14.0-28.28.1~24.04.1" }, { "binary_name": "linux-modules-6.14.0-28-generic", "binary_version": "6.14.0-28.28.1~24.04.1" }, { "binary_name": "linux-riscv-6.14-headers-6.14.0-28", "binary_version": "6.14.0-28.28.1~24.04.1" }, { "binary_name": "linux-riscv-6.14-tools-6.14.0-28", "binary_version": "6.14.0-28.28.1~24.04.1" }, { "binary_name": "linux-tools-6.14.0-28-generic", "binary_version": "6.14.0-28.28.1~24.04.1" } ], "availability": "No subscription required" }
{ "binaries": [ { "binary_name": "bpftool", "binary_version": "7.6.0+6.14.0-28.28" }, { "binary_name": "linux-bpf-dev", "binary_version": "6.14.0-28.28" }, { "binary_name": "linux-buildinfo-6.14.0-28-generic", "binary_version": "6.14.0-28.28" }, { "binary_name": "linux-buildinfo-6.14.0-28-generic-64k", "binary_version": "6.14.0-28.28" }, { "binary_name": "linux-cloud-tools-6.14.0-28", "binary_version": "6.14.0-28.28" }, { "binary_name": "linux-cloud-tools-6.14.0-28-generic", "binary_version": "6.14.0-28.28" }, { "binary_name": "linux-cloud-tools-common", "binary_version": "6.14.0-28.28" }, { "binary_name": "linux-doc", "binary_version": "6.14.0-28.28" }, { "binary_name": "linux-headers-6.14.0-28", "binary_version": "6.14.0-28.28" }, { "binary_name": "linux-headers-6.14.0-28-generic", "binary_version": "6.14.0-28.28" }, { "binary_name": "linux-headers-6.14.0-28-generic-64k", "binary_version": "6.14.0-28.28" }, { "binary_name": "linux-image-6.14.0-28-generic", "binary_version": "6.14.0-28.28" }, { "binary_name": "linux-image-6.14.0-28-generic-dbgsym", "binary_version": "6.14.0-28.28" }, { "binary_name": "linux-image-unsigned-6.14.0-28-generic", "binary_version": "6.14.0-28.28" }, { "binary_name": "linux-image-unsigned-6.14.0-28-generic-64k", "binary_version": "6.14.0-28.28" }, { "binary_name": "linux-image-unsigned-6.14.0-28-generic-64k-dbgsym", "binary_version": "6.14.0-28.28" }, { "binary_name": "linux-image-unsigned-6.14.0-28-generic-dbgsym", "binary_version": "6.14.0-28.28" }, { "binary_name": "linux-lib-rust-6.14.0-28-generic", "binary_version": "6.14.0-28.28" }, { "binary_name": "linux-libc-dev", "binary_version": "6.14.0-28.28" }, { "binary_name": "linux-modules-6.14.0-28-generic", "binary_version": "6.14.0-28.28" }, { "binary_name": "linux-modules-6.14.0-28-generic-64k", "binary_version": "6.14.0-28.28" }, { "binary_name": "linux-modules-extra-6.14.0-28-generic", "binary_version": "6.14.0-28.28" }, { "binary_name": "linux-modules-ipu6-6.14.0-28-generic", "binary_version": "6.14.0-28.28" }, { "binary_name": "linux-modules-ipu7-6.14.0-28-generic", "binary_version": "6.14.0-28.28" }, { "binary_name": "linux-modules-iwlwifi-6.14.0-28-generic", "binary_version": "6.14.0-28.28" }, { "binary_name": "linux-modules-usbio-6.14.0-28-generic", "binary_version": "6.14.0-28.28" }, { "binary_name": "linux-modules-vision-6.14.0-28-generic", "binary_version": "6.14.0-28.28" }, { "binary_name": "linux-perf", "binary_version": "6.14.0-28.28" }, { "binary_name": "linux-source-6.14.0", "binary_version": "6.14.0-28.28" }, { "binary_name": "linux-tools-6.14.0-28", "binary_version": "6.14.0-28.28" }, { "binary_name": "linux-tools-6.14.0-28-generic", "binary_version": "6.14.0-28.28" }, { "binary_name": "linux-tools-6.14.0-28-generic-64k", "binary_version": "6.14.0-28.28" }, { "binary_name": "linux-tools-common", "binary_version": "6.14.0-28.28" }, { "binary_name": "linux-tools-host", "binary_version": "6.14.0-28.28" } ], "availability": "No subscription required" }
{ "binaries": [ { "binary_name": "linux-aws-cloud-tools-6.14.0-1011", "binary_version": "6.14.0-1011.11" }, { "binary_name": "linux-aws-headers-6.14.0-1011", "binary_version": "6.14.0-1011.11" }, { "binary_name": "linux-aws-tools-6.14.0-1011", "binary_version": "6.14.0-1011.11" }, { "binary_name": "linux-buildinfo-6.14.0-1011-aws", "binary_version": "6.14.0-1011.11" }, { "binary_name": "linux-buildinfo-6.14.0-1011-aws-64k", "binary_version": "6.14.0-1011.11" }, { "binary_name": "linux-cloud-tools-6.14.0-1011-aws", "binary_version": "6.14.0-1011.11" }, { "binary_name": "linux-cloud-tools-6.14.0-1011-aws-64k", "binary_version": "6.14.0-1011.11" }, { "binary_name": "linux-headers-6.14.0-1011-aws", "binary_version": "6.14.0-1011.11" }, { "binary_name": "linux-headers-6.14.0-1011-aws-64k", "binary_version": "6.14.0-1011.11" }, { "binary_name": "linux-image-unsigned-6.14.0-1011-aws", "binary_version": "6.14.0-1011.11" }, { "binary_name": "linux-image-unsigned-6.14.0-1011-aws-64k", "binary_version": "6.14.0-1011.11" }, { "binary_name": "linux-image-unsigned-6.14.0-1011-aws-64k-dbgsym", "binary_version": "6.14.0-1011.11" }, { "binary_name": "linux-image-unsigned-6.14.0-1011-aws-dbgsym", "binary_version": "6.14.0-1011.11" }, { "binary_name": "linux-modules-6.14.0-1011-aws", "binary_version": "6.14.0-1011.11" }, { "binary_name": "linux-modules-6.14.0-1011-aws-64k", "binary_version": "6.14.0-1011.11" }, { "binary_name": "linux-modules-extra-6.14.0-1011-aws", "binary_version": "6.14.0-1011.11" }, { "binary_name": "linux-modules-extra-6.14.0-1011-aws-64k", "binary_version": "6.14.0-1011.11" }, { "binary_name": "linux-tools-6.14.0-1011-aws", "binary_version": "6.14.0-1011.11" }, { "binary_name": "linux-tools-6.14.0-1011-aws-64k", "binary_version": "6.14.0-1011.11" } ], "availability": "No subscription required" }
{ "binaries": [ { "binary_name": "linux-buildinfo-6.14.0-1014-gcp", "binary_version": "6.14.0-1014.15" }, { "binary_name": "linux-buildinfo-6.14.0-1014-gcp-64k", "binary_version": "6.14.0-1014.15" }, { "binary_name": "linux-gcp-headers-6.14.0-1014", "binary_version": "6.14.0-1014.15" }, { "binary_name": "linux-gcp-tools-6.14.0-1014", "binary_version": "6.14.0-1014.15" }, { "binary_name": "linux-headers-6.14.0-1014-gcp", "binary_version": "6.14.0-1014.15" }, { "binary_name": "linux-headers-6.14.0-1014-gcp-64k", "binary_version": "6.14.0-1014.15" }, { "binary_name": "linux-image-unsigned-6.14.0-1014-gcp", "binary_version": "6.14.0-1014.15" }, { "binary_name": "linux-image-unsigned-6.14.0-1014-gcp-64k", "binary_version": "6.14.0-1014.15" }, { "binary_name": "linux-image-unsigned-6.14.0-1014-gcp-64k-dbgsym", "binary_version": "6.14.0-1014.15" }, { "binary_name": "linux-image-unsigned-6.14.0-1014-gcp-dbgsym", "binary_version": "6.14.0-1014.15" }, { "binary_name": "linux-modules-6.14.0-1014-gcp", "binary_version": "6.14.0-1014.15" }, { "binary_name": "linux-modules-6.14.0-1014-gcp-64k", "binary_version": "6.14.0-1014.15" }, { "binary_name": "linux-modules-extra-6.14.0-1014-gcp", "binary_version": "6.14.0-1014.15" }, { "binary_name": "linux-modules-extra-6.14.0-1014-gcp-64k", "binary_version": "6.14.0-1014.15" }, { "binary_name": "linux-tools-6.14.0-1014-gcp", "binary_version": "6.14.0-1014.15" }, { "binary_name": "linux-tools-6.14.0-1014-gcp-64k", "binary_version": "6.14.0-1014.15" } ], "availability": "No subscription required" }
{ "binaries": [ { "binary_name": "linux-buildinfo-6.14.0-1011-oracle", "binary_version": "6.14.0-1011.11" }, { "binary_name": "linux-buildinfo-6.14.0-1011-oracle-64k", "binary_version": "6.14.0-1011.11" }, { "binary_name": "linux-headers-6.14.0-1011-oracle", "binary_version": "6.14.0-1011.11" }, { "binary_name": "linux-headers-6.14.0-1011-oracle-64k", "binary_version": "6.14.0-1011.11" }, { "binary_name": "linux-image-unsigned-6.14.0-1011-oracle", "binary_version": "6.14.0-1011.11" }, { "binary_name": "linux-image-unsigned-6.14.0-1011-oracle-64k", "binary_version": "6.14.0-1011.11" }, { "binary_name": "linux-image-unsigned-6.14.0-1011-oracle-64k-dbgsym", "binary_version": "6.14.0-1011.11" }, { "binary_name": "linux-image-unsigned-6.14.0-1011-oracle-dbgsym", "binary_version": "6.14.0-1011.11" }, { "binary_name": "linux-modules-6.14.0-1011-oracle", "binary_version": "6.14.0-1011.11" }, { "binary_name": "linux-modules-6.14.0-1011-oracle-64k", "binary_version": "6.14.0-1011.11" }, { "binary_name": "linux-modules-extra-6.14.0-1011-oracle", "binary_version": "6.14.0-1011.11" }, { "binary_name": "linux-modules-extra-6.14.0-1011-oracle-64k", "binary_version": "6.14.0-1011.11" }, { "binary_name": "linux-oracle-headers-6.14.0-1011", "binary_version": "6.14.0-1011.11" }, { "binary_name": "linux-oracle-tools-6.14.0-1011", "binary_version": "6.14.0-1011.11" }, { "binary_name": "linux-tools-6.14.0-1011-oracle", "binary_version": "6.14.0-1011.11" }, { "binary_name": "linux-tools-6.14.0-1011-oracle-64k", "binary_version": "6.14.0-1011.11" } ], "availability": "No subscription required" }
{ "binaries": [ { "binary_name": "linux-buildinfo-6.14.0-1012-raspi", "binary_version": "6.14.0-1012.12" }, { "binary_name": "linux-headers-6.14.0-1012-raspi", "binary_version": "6.14.0-1012.12" }, { "binary_name": "linux-image-6.14.0-1012-raspi", "binary_version": "6.14.0-1012.12" }, { "binary_name": "linux-image-6.14.0-1012-raspi-dbgsym", "binary_version": "6.14.0-1012.12" }, { "binary_name": "linux-modules-6.14.0-1012-raspi", "binary_version": "6.14.0-1012.12" }, { "binary_name": "linux-raspi-headers-6.14.0-1012", "binary_version": "6.14.0-1012.12" }, { "binary_name": "linux-raspi-tools-6.14.0-1012", "binary_version": "6.14.0-1012.12" }, { "binary_name": "linux-tools-6.14.0-1012-raspi", "binary_version": "6.14.0-1012.12" } ], "availability": "No subscription required" }
{ "binaries": [ { "binary_name": "linux-buildinfo-6.14.0-1010-realtime", "binary_version": "6.14.0-1010.10" }, { "binary_name": "linux-cloud-tools-6.14.0-1010-realtime", "binary_version": "6.14.0-1010.10" }, { "binary_name": "linux-headers-6.14.0-1010-realtime", "binary_version": "6.14.0-1010.10" }, { "binary_name": "linux-image-unsigned-6.14.0-1010-realtime", "binary_version": "6.14.0-1010.10" }, { "binary_name": "linux-image-unsigned-6.14.0-1010-realtime-dbgsym", "binary_version": "6.14.0-1010.10" }, { "binary_name": "linux-modules-6.14.0-1010-realtime", "binary_version": "6.14.0-1010.10" }, { "binary_name": "linux-modules-extra-6.14.0-1010-realtime", "binary_version": "6.14.0-1010.10" }, { "binary_name": "linux-modules-iwlwifi-6.14.0-1010-realtime", "binary_version": "6.14.0-1010.10" }, { "binary_name": "linux-realtime-cloud-tools-6.14.0-1010", "binary_version": "6.14.0-1010.10" }, { "binary_name": "linux-realtime-headers-6.14.0-1010", "binary_version": "6.14.0-1010.10" }, { "binary_name": "linux-realtime-tools-6.14.0-1010", "binary_version": "6.14.0-1010.10" }, { "binary_name": "linux-tools-6.14.0-1010-realtime", "binary_version": "6.14.0-1010.10" } ], "availability": "No subscription required" }
{ "binaries": [ { "binary_name": "linux-buildinfo-6.14.0-28-generic", "binary_version": "6.14.0-28.28.1" }, { "binary_name": "linux-headers-6.14.0-28-generic", "binary_version": "6.14.0-28.28.1" }, { "binary_name": "linux-image-6.14.0-28-generic", "binary_version": "6.14.0-28.28.1" }, { "binary_name": "linux-image-6.14.0-28-generic-dbgsym", "binary_version": "6.14.0-28.28.1" }, { "binary_name": "linux-modules-6.14.0-28-generic", "binary_version": "6.14.0-28.28.1" }, { "binary_name": "linux-riscv-headers-6.14.0-28", "binary_version": "6.14.0-28.28.1" }, { "binary_name": "linux-riscv-tools-6.14.0-28", "binary_version": "6.14.0-28.28.1" }, { "binary_name": "linux-tools-6.14.0-28-generic", "binary_version": "6.14.0-28.28.1" } ], "availability": "No subscription required" }