Public bug reported:
## Affects
- linux (Ubuntu) — Noble 6.8
## Description
Two bugs in FAN SAUCE networking code:
### Bug 1: Missing prefix range validation
net/ipv4/ipip.c:609-661 and drivers/net/vxlan/vxlan_core.c:116-160
overlay_prefix and underlay_prefix (u16, user-controlled via netlink)
are not validated to be in range [0, 32]. In the transmit path, the
shift amount `underlay_prefix - overlay_prefix` can be negative
(undefined behavior). inet_make_mask() also has UB for values > 32.
On x86, shift wraps (masked to 5 bits) producing wrong destination
addresses -> traffic misdirection.
Triggerable by CAP_NET_ADMIN (or unpriv via user+net namespace).
### Bug 2: Unsafe list iteration in fan_flush_map
net/ipv4/ipip.c:585-589 and drivers/net/vxlan/vxlan_core.c:92-99
list_for_each_entry_rcu() used to iterate fan_maps while calling
list_del_rcu() + kfree_rcu() on each entry. Problems:
- Not inside rcu_read_lock() (write-side path) -> lockdep warning
- Should use _safe variant when deleting during iteration
Works by accident (list_del_rcu preserves next pointers).
## Impact
Bug 1: Undefined behavior + tunnel traffic misdirection. Medium.
Bug 2: Code correctness, lockdep warnings. Low.
## Suggested fix
Bug 1: Validate overlay_prefix and underlay_prefix in [0, 32] and
require underlay_prefix >= overlay_prefix.
Bug 2: Replace list_for_each_entry_rcu with list_for_each_entry_safe.
## Discovery method
LLM-assisted code review of Ubuntu SAUCE FAN networking
** Affects: linux (Ubuntu)
Importance: Undecided
Status: New
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2173154
Title:
[Ubuntu Noble 6.8] FAN ipip/VXLAN: missing prefix validation + unsafe
list iteration in fan_flush_map
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2173154/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
