Listen to this Post
The `bpf_redirect_peer` helper function in the Linux kernel is used by BPF programs to redirect a packet to a network interface in a different network namespace (netns). When performing this redirection, the kernel did not properly “scrub” or clean the packet’s socket buffer (skb) metadata. Specifically, active socket buffer extensions were not cleared. These extensions can contain security-sensitive information from the source namespace. In a documented scenario, this flaw caused unexpected packet drops in containerized environments using IPsec (Cilium). After a packet was decrypted by IPsec in the host netns, the XFRM state information was stored in the `skb` extensions. When `bpf_redirect_peer` moved this packet to a container netns, the preserved XFRM state triggered a policy check (__xfrm_policy_check) in the new namespace. Since the container had no matching XFRM policy, the kernel incorrectly dropped the packet with a `LINUX_MIB_XFRMINNOPOLS` error, causing a denial of service.
Platform: Linux Kernel
Version: Up to
Vulnerability: Information Leak
Severity: Medium
date: 2025-05-20
Prediction: 2025-06-30
What Undercode Say:
Check kernel version uname -r Examine loaded BPF programs using bpftool bpftool prog list Trace packet flow across namespaces (requires pwru) pwru --filter-port 53 Check for active XFRM states and policies ip xfrm state list && ip xfrm policy list
// Example vulnerable code path in kernel < 6.1.139, 6.6.91, etc.
// The skb extensions were not scrubbed in bpf_redirect_peer.
static int skb_do_redirect(struct sk_buff skb, ...) {
// ... missing scrubbing call like skb_scrub_packet(skb, true) ...
return dev_queue_xmit(skb);
}
How Exploit:
- Attacker operates in a namespace with IPsec decryption.
- Legitimate packet is decrypted, embedding XFRM state in skb extensions.
- BPF program uses `bpf_redirect_peer` to send packet to target container namespace.
- Kernel in target namespace performs XFRM policy check on lingering host state.
5. Policy mismatch causes packet drop (Denial-of-Service).
Protection from this CVE
Apply kernel patch.
Update to fixed version.
Disable vulnerable BPF helpers.
Impact:
Network DoS.
Cross-namespace data leak.
IPsec traffic failure.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
