Technical impact
The vulnerability resides in the tun subsystem of the Linux kernel. The function tun_put_user() allocates a stack‑based struct virtio_net_hdr_v1_hash_tunnel but only initializes the first 10 bytes for packets that are not tunneled. An attacker can set the virtual network header size to 24 bytes via the TUNSETVNETHDRSZ ioctl, causing the partially initialized 24‑byte structure to be copied into user space on every read of a non‑tunnel packet. Each read leaks 14 bytes of kernel stack memory, providing an unprivileged local user with confidential kernel data that may assist in more advanced attacks.
Affected Systems
Any Linux kernel build that predates commit 585cb85e9a29185be05f326369573c2663cf4380 is susceptible. Those kernels lack the patch that zeroes the entire vnet header before it is sent to user space. Administrators should compare their running kernel version against that commit or install a kernel version that includes the fix.
Risk and Exploitability
The CVSS score is 5.5, reflecting a moderate severity for a local information‑disclosure flaw. The EPSS score of less than 1% indicates a low but non‑zero probability of exploitation. The vulnerability is local and does not require elevated privileges; any user with access to a tun device can trigger the leak. While the flaw itself does not grant arbitrary code execution, the disclosed kernel stack data may aid attackers in discovering additional vulnerabilities or refining exploitation techniques. The issue is not listed in the CISA KEV catalog, but the potential for aiding future exploits warrants timely remediation.
Ubuntu USN