{ "dataType": "CVE_RECORD", "cveMetadata": { "cveId": "CVE-2024-26882", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-02-19T14:20:24.185Z", "datePublished": "2024-04-17T10:27:38.389Z", "dateUpdated": "2026-08-12T17:30:31.909Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:28:07.358Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ip_tunnel: make sure to pull inner header in ip_tunnel_rcv()\n\nApply the same fix than ones found in :\n\n8d975c15c0cd (\"ip6_tunnel: make sure to pull inner header in __ip6_tnl_rcv()\")\n1ca1ba465e55 (\"geneve: make sure to pull inner header in geneve_rx()\")\n\nWe have to save skb->network_header in a temporary variable\nin order to be able to recompute the network_header pointer\nafter a pskb_inet_may_pull() call.\n\npskb_inet_may_pull() makes sure the needed headers are in skb->head.\n\nsyzbot reported:\nBUG: KMSAN: uninit-value in __INET_ECN_decapsulate include/net/inet_ecn.h:253 [inline]\n BUG: KMSAN: uninit-value in INET_ECN_decapsulate include/net/inet_ecn.h:275 [inline]\n BUG: KMSAN: uninit-value in IP_ECN_decapsulate include/net/inet_ecn.h:302 [inline]\n BUG: KMSAN: uninit-value in ip_tunnel_rcv+0xed9/0x2ed0 net/ipv4/ip_tunnel.c:409\n __INET_ECN_decapsulate include/net/inet_ecn.h:253 [inline]\n INET_ECN_decapsulate include/net/inet_ecn.h:275 [inline]\n IP_ECN_decapsulate include/net/inet_ecn.h:302 [inline]\n ip_tunnel_rcv+0xed9/0x2ed0 net/ipv4/ip_tunnel.c:409\n __ipgre_rcv+0x9bc/0xbc0 net/ipv4/ip_gre.c:389\n ipgre_rcv net/ipv4/ip_gre.c:411 [inline]\n gre_rcv+0x423/0x19f0 net/ipv4/ip_gre.c:447\n gre_rcv+0x2a4/0x390 net/ipv4/gre_demux.c:163\n ip_protocol_deliver_rcu+0x264/0x1300 net/ipv4/ip_input.c:205\n ip_local_deliver_finish+0x2b8/0x440 net/ipv4/ip_input.c:233\n NF_HOOK include/linux/netfilter.h:314 [inline]\n ip_local_deliver+0x21f/0x490 net/ipv4/ip_input.c:254\n dst_input include/net/dst.h:461 [inline]\n ip_rcv_finish net/ipv4/ip_input.c:449 [inline]\n NF_HOOK include/linux/netfilter.h:314 [inline]\n ip_rcv+0x46f/0x760 net/ipv4/ip_input.c:569\n __netif_receive_skb_one_core net/core/dev.c:5534 [inline]\n __netif_receive_skb+0x1a6/0x5a0 net/core/dev.c:5648\n netif_receive_skb_internal net/core/dev.c:5734 [inline]\n netif_receive_skb+0x58/0x660 net/core/dev.c:5793\n tun_rx_batched+0x3ee/0x980 drivers/net/tun.c:1556\n tun_get_user+0x53b9/0x66e0 drivers/net/tun.c:2009\n tun_chr_write_iter+0x3af/0x5d0 drivers/net/tun.c:2055\n call_write_iter include/linux/fs.h:2087 [inline]\n new_sync_write fs/read_write.c:497 [inline]\n vfs_write+0xb6b/0x1520 fs/read_write.c:590\n ksys_write+0x20f/0x4c0 fs/read_write.c:643\n __do_sys_write fs/read_write.c:655 [inline]\n __se_sys_write fs/read_write.c:652 [inline]\n __x64_sys_write+0x93/0xd0 fs/read_write.c:652\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x63/0x6b\n\nUninit was created at:\n __alloc_pages+0x9a6/0xe00 mm/page_alloc.c:4590\n alloc_pages_mpol+0x62b/0x9d0 mm/mempolicy.c:2133\n alloc_pages+0x1be/0x1e0 mm/mempolicy.c:2204\n skb_page_frag_refill+0x2bf/0x7c0 net/core/sock.c:2909\n tun_build_skb drivers/net/tun.c:1686 [inline]\n tun_get_user+0xe0a/0x66e0 drivers/net/tun.c:1826\n tun_chr_write_iter+0x3af/0x5d0 drivers/net/tun.c:2055\n call_write_iter include/linux/fs.h:2087 [inline]\n new_sync_write fs/read_write.c:497 [inline]\n vfs_write+0xb6b/0x1520 fs/read_write.c:590\n ksys_write+0x20f/0x4c0 fs/read_write.c:643\n __do_sys_write fs/read_write.c:655 [inline]\n __se_sys_write fs/read_write.c:652 [inline]\n __x64_sys_write+0x93/0xd0 fs/read_write.c:652\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x63/0x6b" } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "baseScore": 7.3, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:N - The vulnerable code runs in the GRE/gretap/ERSPAN/ipip/sit decapsulation receive path (`gre_rcv` → `__ipgre_rcv` → `ip_tunnel_rcv`), processing IP protocol 47/4/41 packets routed from anywhere on the internet. A remote attacker produces the required non-linear skb deterministically by IP-fragmenting the tunnel packet so reassembly leaves the linear area ending at the inner network header.\nAC:L - The attacker fully controls the packet layout: `pskb_may_pull()`/`__pskb_pull_tail()` pull exactly the requested bytes, so a chosen fragment split reliably leaves zero linear bytes at the inner header on every packet, and for gretap/ERSPAN the `pskb_may_pull(ETH_HLEN)` in `__iptunnel_pull_header()` lands the boundary automatically.\nPR:N - GRE and IPIP/SIT have no authentication whatsoever, and `ip_tunnel_lookup()` has wildcard-remote, collect_md and fallback-device passes that match packets from any source address, so no account or credentials on the target are required.\nUI:N - Decapsulation happens automatically in softirq context on packet receipt; no action by any local user or administrator is needed beyond the tunnel already being configured and up.\nS:U - The uninitialized read and the resulting mis-handled packet stay entirely within the kernel's own security authority; no VM, IOMMU, container or sandbox boundary is crossed.\nC:L - One to two bytes of uninitialized/stale kernel memory past `skb_tail_pointer()` (heap padding or `skb_shared_info` bytes) are read, and their low ECN bits are inferable by the attacker from whether the tunneled packet is delivered or dropped — a real but strictly bounded, low-bandwidth disclosure oracle rather than arbitrary memory read.\nI:L - No out-of-bounds write is reachable because `INET_ECN_set_ce()`/`INET_ECN_set_ect1()` bounds-check against the tail pointer, but the RFC 6040 decapsulation decision — whether the congestion (CE) signal is propagated to the inner packet and whether the frame is accepted — is driven by uninitialized memory, corrupting the ECN state of legitimate decapsulated traffic.\nA:L - The read always stays inside the skb head allocation (`skb_shared_info` follows `skb->end`), so no oops or panic is reachable on a production kernel; the effect is that legitimate tunneled packets are non-deterministically dropped via the `err > 1` path (`rx_frame_errors`/`rx_errors`), degrading the tunnel rather than the host." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/ipv4/ip_tunnel.c" ], "versions": [ { "version": "c54419321455631079c7d6e60bc732dd0c5914c5", "lessThan": "ec6bb01e02cbd47781dd90775b631a1dc4bd9d2b", "status": "affected", "versionType": "git" }, { "version": "c54419321455631079c7d6e60bc732dd0c5914c5", "lessThan": "77fd5294ea09b21f6772ac954a121b87323cec80", "status": "affected", "versionType": "git" }, { "version": "c54419321455631079c7d6e60bc732dd0c5914c5", "lessThan": "5c03387021cfa3336b97e0dcba38029917a8af2a", "status": "affected", "versionType": "git" }, { "version": "c54419321455631079c7d6e60bc732dd0c5914c5", "lessThan": "60044ab84836359534bd7153b92e9c1584140e4a", "status": "affected", "versionType": "git" }, { "version": "c54419321455631079c7d6e60bc732dd0c5914c5", "lessThan": "c4c857723b37c20651300b3de4ff25059848b4b0", "status": "affected", "versionType": "git" }, { "version": "c54419321455631079c7d6e60bc732dd0c5914c5", "lessThan": "f6723d8dbfdc10c784a56748f86a9a3cd410dbd5", "status": "affected", "versionType": "git" }, { "version": "c54419321455631079c7d6e60bc732dd0c5914c5", "lessThan": "ca914f1cdee8a85799942c9b0ce5015bbd6844e1", "status": "affected", "versionType": "git" }, { "version": "c54419321455631079c7d6e60bc732dd0c5914c5", "lessThan": "b0ec2abf98267f14d032102551581c833b0659d3", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/ipv4/ip_tunnel.c" ], "versions": [ { "version": "3.10", "status": "affected" }, { "version": "0", "lessThan": "3.10", "status": "unaffected", "versionType": "semver" }, { "version": "5.4.273", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.214", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.153", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.83", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.23", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.7.11", "lessThanOrEqual": "6.7.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.8.2", "lessThanOrEqual": "6.8.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.9", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.10", "versionEndExcluding": "5.4.273" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.10", "versionEndExcluding": "5.10.214" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.10", "versionEndExcluding": "5.15.153" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.10", "versionEndExcluding": "6.1.83" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.10", "versionEndExcluding": "6.6.23" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.10", "versionEndExcluding": "6.7.11" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.10", "versionEndExcluding": "6.8.2" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.10", "versionEndExcluding": "6.9" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/ec6bb01e02cbd47781dd90775b631a1dc4bd9d2b" }, { "url": "https://git.kernel.org/stable/c/77fd5294ea09b21f6772ac954a121b87323cec80" }, { "url": "https://git.kernel.org/stable/c/5c03387021cfa3336b97e0dcba38029917a8af2a" }, { "url": "https://git.kernel.org/stable/c/60044ab84836359534bd7153b92e9c1584140e4a" }, { "url": "https://git.kernel.org/stable/c/c4c857723b37c20651300b3de4ff25059848b4b0" }, { "url": "https://git.kernel.org/stable/c/f6723d8dbfdc10c784a56748f86a9a3cd410dbd5" }, { "url": "https://git.kernel.org/stable/c/ca914f1cdee8a85799942c9b0ce5015bbd6844e1" }, { "url": "https://git.kernel.org/stable/c/b0ec2abf98267f14d032102551581c833b0659d3" } ], "title": "net: ip_tunnel: make sure to pull inner header in ip_tunnel_rcv()", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "problemTypes": [ { "descriptions": [ { "type": "CWE", "cweId": "CWE-457", "lang": "en", "description": "CWE-457 Use of Uninitialized Variable" } ] } ], "metrics": [ { "other": { "type": "ssvc", "content": { "timestamp": "2026-08-12T17:27:05.503250Z", "id": "CVE-2024-26882", "options": [ { "Exploitation": "none" }, { "Automatable": "yes" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "version": "2.0.3" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-12T17:30:31.909Z" } }, { "title": "CVE Program Container", "references": [ { "url": "https://git.kernel.org/stable/c/ec6bb01e02cbd47781dd90775b631a1dc4bd9d2b", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/77fd5294ea09b21f6772ac954a121b87323cec80", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/5c03387021cfa3336b97e0dcba38029917a8af2a", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/60044ab84836359534bd7153b92e9c1584140e4a", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/c4c857723b37c20651300b3de4ff25059848b4b0", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/f6723d8dbfdc10c784a56748f86a9a3cd410dbd5", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/ca914f1cdee8a85799942c9b0ce5015bbd6844e1", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/b0ec2abf98267f14d032102551581c833b0659d3", "tags": [ "x_transferred" ] }, { "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html", "tags": [ "x_transferred" ] }, { "url": "https://security.netapp.com/advisory/ntap-20241220-0002/" } ], "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-12-20T13:06:43.371Z" } }, { "x_adpType": "supplier", "providerMetadata": { "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-05-12T11:50:05.762Z" }, "affected": [ { "vendor": "Siemens", "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem", "versions": [ { "status": "affected", "version": "0", "lessThan": "*", "versionType": "custom" } ], "defaultStatus": "unknown" } ], "references": [ { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ] } ] }, "dataVersion": "5.2" }