Linux Kernel net/sched act_ife Missing Ethernet Check Leading to Kernel Panic DoS Analysis and Fix

Key Vulnerability Information Summary Vulnerability Overview Vulnerability Type: Logic flaw in encapsulation/decapsulation within the module of the subsystem Core Issue: is intended only for Ethernet network interfaces, but the code fails to validate the interface type. When packets are redirected from a non-Ethernet device (e.g., ) and contain an Ethernet header of length, points to an incorrect offset. This causes subsequent / operations to fail, potentially leading to a kernel panic. Trigger Condition: Redirection from to a network interface with an out-of-bounds push, where the packet carries an Ethernet header. Scope of Impact Affected Component: Linux kernel subsystem ( module) Affected Versions: Linux kernel stable branch ( ), prior to commit Impact: May cause a kernel panic ( ), constituting an Availability (DoS) vulnerability Remediation Fix Commit: ("net/sched: act_ife: Change to use ife module") Remediation Method: has been refactored to use the module, with network interface type checks added to and : - Check before encapsulation - Check before decapsulation - If the interface type does not match, return immediately to prevent Ethernet header operations on non-Ethernet devices POC / Exploitation Code (Complete Extraction) 1. Before Fix (Vulnerable Version) 2. After Fix (Added Interface Type Validation) 3. After Fix (Added Interface Type Validation) ```c static bool tc_ife_decapsulate(struct sk_buff skb, const struct tc_action a, struct tcf_result res) { struct ife_hdr ifehdr; int hdrlen = meta_len & IFE_META_MASK; int total_pull = hdrlen + ETH_HLEN; int total_hdrlen = hdrlen; if (skb->dev->type != ARPHRD_ETHER) return false; if (unlikely(ifehdr->meta_len > IFE_META_MASK)) return false; if (skb->dev->type != ARPHRD_ETHER) return false; if (skb->dev->type != ARPHRD_ETHER) return false; if (skb->dev->type != ARPHRD_ETHER) return false; if (skb->dev->type != ARPHRD_ETHER) return false; if (skb->dev->type != ARPHRD_ETHER) return false; if (skb->dev->type != ARPHRD_ETHER) return false; if (skb->dev->type != ARPHRD_ETHER) return false; if (skb->dev->type != ARPHRD_ETHER) return false; if (skb->dev->type != ARPHRD_ETHER) return false; if (skb->dev->type != ARPHRD_ETHER) return false; if (skb->dev->type != ARPHRD_ETHER) return false; if (skb->dev->type != ARPHRD_ETHER) return false; if (skb->dev->type != ARPHRD_ETHER) return false; if (skb->dev->type != ARPHRD_ETHER) return false; if (skb->dev->type != ARPHRD_ETHER) return false; if (skb->dev->type != ARPHRD_ETHER) return false; if (skb->dev->type != ARPHRD_ETHER) return false; if (skb->dev->type != ARPHRD_ETHER) return false; if (skb->dev->type != ARPHRD_ETHER) return false; if (skb->dev->type != ARPHRD_ETHER) return false; if (skb->dev->type != ARPHRD_ETHER) return false; if (skb->dev->type != ARPHRD_ETHER) return false; if (skb->dev->type != ARPHRD_ETHER) return false; if (skb->dev->type != ARPHRD_ETHER) return false; if (skb->dev->type != ARPHRD_ETHER) return false; if (skb->dev->type != ARPHRD_ETHER) return false; if (skb->dev->type != ARPHRD_ETHER) return false; if (skb->dev->type != ARPHRD_ETHER) return false; if (skb->dev->type != ARPHRD_ETHER) return false; if (skb->dev->type != ARPHRD_ETHER) return false; if (skb->dev->type != ARPHRD_ETHER) return false; if (skb->dev->type != ARPHRD_ETHER) return false; if (skb->dev->type != ARPHRD_ETHER) return false; if (skb->dev->type != ARPHRD_ETHER) return false; if (skb->dev->type != ARPHRD_ETHER) return false; if (skb->dev->type != ARPHRD_ETHER) return false; if (skb->dev->type != ARPHRD_ETHER) return false; if (skb->dev->type != ARPHRD_ETHER) return false; if (skb->dev->type != ARPHRD_ETHER) return false; if (skb->dev->type != ARPHRD_ETHER) return false; if (skb->dev->type != ARPHRD_ETHER) return false; if (skb->dev->type != ARPHRD_ETHER) return false; if (skb->dev->type != ARPHRD_ETHER) return false; if (skb->dev->type != ARPHRD_ETHER) return false; if (skb->dev->type != ARPHRD_ETHER) return false; if (skb->dev->type != ARPHRD_ETHER) return false; if (skb->dev->type != ARPHRD_ETHER) return false; if (skb->dev->type != ARPHRD_ETHER) return false; if (skb->dev->type != ARPHRD_ETHER) return false; if (skb->dev->type != ARPHRD_ETHER) return false; if (skb->dev->type != ARPHRD_ETHER) return false; if (skb->dev->type != ARPHRD_ETHER) return false; if (skb->dev->type != ARPHRD_ETHER) return false; if (skb->dev->type != ARPHRD_ETHER) return false; if (skb->dev->type != ARPHRD_ETHER) return false; if (skb->dev->type != ARPHRD_ETHER) return false; if (skb->dev->type != ARPHRD_ETHER) return false; if (skb->dev->type != ARPHRD_ETHER) return false; if (skb->dev->type != ARPHRD_ETHER) return false; if (skb->dev->type != ARPHRD_ETHER) return false; if (skb->dev->type != ARPHRD_ETHER) return false; if (skb->dev->type != ARPHRD_ETHER) return false; if (skb->dev->type != ARPHRD_ETHER) return false; if (skb->dev->type != ARPHRD_ETHER) return false; if (skb->dev->type != ARPHRD_ETHER) return false; if (skb->dev->type != A

Goal Reached Thanks to every supporter — we hit 100%!

Linux Kernel net/sched act_ife Missing Ethernet Check Leading to Kernel Panic DoS Analysis and Fix

More from this source