## Summary
A Linux kernel ipv6: sit (SIT tunnel) vulnerability can lead to use-after-free of the cached inner IPv6 header pointer during GSO offload handling in ipip6_tunnel_xmit(). The issue is triggered when offload helpers unclone/expand the sk_buff header, leaving stale pointers used for subsequent reads.
## Technical Details
- Root cause: ipip6_tunnel_xmit() caches an inner IPv6 header pointer (iph6) at function entry and continues using it after iptunnel_handle_offloads().
- Trigger: For GSO sk_buffs, iptunnel_handle_offloads() calls skb_header_unclone(), which can call pskb_expand_head().
- pskb_expand_head() may move the skb head; the pskb_expand_head() contract requires pointers into the skb header to be reloaded after the call.
- If the later skb_realloc_headroom() branch is not taken, SIT reads the inner hop limit and DS field using the stale iph6 pointer.
- Consequence: the stale pointer may reference a freed skb head after the old head’s remaining clone is released.
- Fix strategy (as described in the patch): reload iph6 after the offload helper succeeds and before subsequent reads from the inner IPv6 header, while keeping the existing reload after skb_realloc_headroom().
## Affected
- Linux kernel 3.18 - 5.10.259 (exclusive)
## Impact
- High-risk memory safety issue: stale pointer dereference can read from freed memory in kernel networking code.
- Potential outcomes align with the provided CVSS: confidentiality, integrity, and availability impact.
## Mitigation
1. Patch immediately with the stable backport containing the ipv6: sit: reload inner IPv6 header after GSO offloads change (e.g., commits referenced as 0bfa7bba1f41aaf5f0604dc712bb4701493e3aa0, 1132e5edc2866c3530be17622153a597095f0e43, 2fa49b2715e1bad12ce3b0fa64e234d9582c8193).
2. If patching is delayed, reduce exposure by limiting use of SIT/ipip6_tunnel_xmit() paths and GSO skbs on affected systems (per your operational constraints).
3. Monitor for kernel crashes or anomalous behavior in IPv6 tunnel TX paths; the issue was reported by syzbot ([email protected]).
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD-CWE-noinfo