CVE-2024-41091: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-41091 is a vulnerability in the Linux kernel's tun driver that was discovered and resolved in July 2024. The vulnerability stems from a missing verification of frame length in the tun_xdp_one() path, which could allow corrupted socket buffers (skb) to be sent downstack (NVD).

The vulnerability occurs when the tun_xdp_one->eth_type_trans() function may access the Ethernet header although it can be less than ETH_HLEN (minimum Ethernet header length). This oversight could lead to out-of-bound access beyond the actual length or cause confusion in the underlayer with incorrect or inconsistent header length in the skb metadata. The issue was introduced in commit 043d222f93ab which added support for accepting an array of XDP buffs through sendmsg() (Kernel Commit). The vulnerability has been assigned a CVSS 3.1 score of 7.1, indicating a high severity level (Broadcom Advisory).

When exploited, this vulnerability could lead to out-of-bound memory access beyond the actual buffer length or cause inconsistencies in network packet processing. This could potentially result in system instability or denial of service conditions (Red Hat Advisory).

The vulnerability requires the ability to send specially crafted network packets through the tun interface. The alternative path (tun_get_user()) already had protection against short frames, but the tun_xdp_one() path was left exposed (Kernel Commit).

The vulnerability has been patched by adding a verification check that drops any frame shorter than the Ethernet header size in the tun_xdp_one() path, similar to how tun_get_user() handles such cases. The fix has been backported to various stable kernel versions and is available through distribution security updates (Red Hat Advisory).