Kestrel
대시보드로 돌아가기
CVE-2025-37959MEDIUM· 5.5MITRENVD대응게시일: 2025. 05. 20.수정일: 2026. 07. 14.CNA: 416baaa9-dc9f-4396-8d5f-8c081fb06d67Modified

In the Linux kernel, the following vulnerability has been resolved: bpf: Scrub packet on bpf_redirect_peer When bpf_redirect_peer is used

위협 신호 · CVSS · EPSS · KEV

정기 패치· 높은 악용 신호 없음
CVSS
5.5medium

이론적 심각도 점수

EPSS
0.2%상위 94.9%

30일 내 악용 확률 예측

KEV
미등재

실측 악용 기록 없음

권장 대응 기한차기 업그레이드 시CISA SSVC 기준

별도 긴급 패치 불필요 — 정기 시스템 업그레이드 주기에 맞춰 조치

· KEV 미등재 · 자동화 어려움 · 부분 영향 · 내부 한정

CVSS 벡터 · 메트릭

악용 경로
공격 벡터로컬
공격 복잡도낮음
필요 권한낮음
사용자 상호작용불필요
범위불변
영향
기밀성 영향없음
무결성 영향없음
가용성 영향높음
버전별 점수
CVSS 3.15.5MEDIUM· 악용성 1.8· 영향도 3.6
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

상세 설명

In the Linux kernel, the following vulnerability has been resolved:

bpf: Scrub packet on bpf_redirect_peer

When bpf_redirect_peer is used to redirect packets to a device in
another network namespace, the skb isn't scrubbed. That can lead skb
information from one namespace to be "misused" in another namespace.

As one example, this is causing Cilium to drop traffic when using
bpf_redirect_peer to redirect packets that just went through IPsec
decryption to a container namespace. The following pwru trace shows (1)
the packet path from the host's XFRM layer to the container's XFRM
layer where it's dropped and (2) the number of active skb extensions at
each function.

text
 1NETNS       MARK  IFACE  TUPLE                                FUNC
 24026533547  d00   eth0   10.244.3.124:35473->10.244.2.158:53  xfrm_rcv_cb
 3                         .active_extensions = (__u8)2,
 44026533547  d00   eth0   10.244.3.124:35473->10.244.2.158:53  xfrm4_rcv_cb
 5                         .active_extensions = (__u8)2,
 64026533547  d00   eth0   10.244.3.124:35473->10.244.2.158:53  gro_cells_receive
 7                         .active_extensions = (__u8)2,
 8[...]
 94026533547  0     eth0   10.244.3.124:35473->10.244.2.158:53  skb_do_redirect
10                         .active_extensions = (__u8)2,
114026534999  0     eth0   10.244.3.124:35473->10.244.2.158:53  ip_rcv
12                         .active_extensions = (__u8)2,
134026534999  0     eth0   10.244.3.124:35473->10.244.2.158:53  ip_rcv_core
14                         .active_extensions = (__u8)2,
15[...]
164026534999  0     eth0   10.244.3.124:35473->10.244.2.158:53  udp_queue_rcv_one_skb
17                         .active_extensions = (__u8)2,
184026534999  0     eth0   10.244.3.124:35473->10.244.2.158:53  __xfrm_policy_check
19                         .active_extensions = (__u8)2,
204026534999  0     eth0   10.244.3.124:35473->10.244.2.158:53  __xfrm_decode_session
21                         .active_extensions = (__u8)2,
224026534999  0     eth0   10.244.3.124:35473->10.244.2.158:53  security_xfrm_decode_session
23                         .active_extensions = (__u8)2,
244026534999  0     eth0   10.244.3.124:35473->10.244.2.158:53  kfree_skb_reason(SKB_DROP_REASON_XFRM_POLICY)
25                         .active_extensions = (__u8)2,

In this case, there are no XFRM policies in the container's network
namespace so the drop is unexpected. When we decrypt the IPsec packet,
the XFRM state used for decryption is set in the skb extensions. This
information is preserved across the netns switch. When we reach the
XFRM policy check in the container's netns, __xfrm_policy_check drops
the packet with LINUX_MIB_XFRMINNOPOLS because a (container-side) XFRM
policy can't be found that matches the (host-side) XFRM state used for
decryption.

This patch fixes this by scrubbing the packet when using
bpf_redirect_peer, as is done on typical netns switches via veth
devices except skb->mark and skb->tstamp are not zeroed.

AI 심층 분석

공격 시나리오 · 재현 가능한 PoC 페이로드 · 즉시 적용 가능한 차단 패치를 한 번에 받아 보세요. 보안 운영팀이 그대로 점검·티켓팅에 쓸 수 있는 형태로 정리해 드립니다.

영향받는 제품·버전

  • linux linux_kernel5.10 - 6.1.139
    linux
  • linux linux_kernel6.2 - 6.6.91
    linux
  • linux linux_kernel6.7 - 6.12.29
    linux
  • linux linux_kernel6.13 - 6.14.7
    linux
  • linux linux_kernel
    linux
  • linux linux_kernel
    linux
  • linux linux_kernel
    linux
  • linux linux_kernel
    linux
  • linux linux_kernel
    linux
  • debian debian_linux
    linux

영향받는 구성 (CPE) 7

  • linux linux_kernel≥ 5.10 < 6.1.139cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
  • linux linux_kernel 6.15cpe:2.3:o:linux:linux_kernel:6.15:rc1:*:*:*:*:*:*
  • linux linux_kernel 6.15cpe:2.3:o:linux:linux_kernel:6.15:rc2:*:*:*:*:*:*
  • linux linux_kernel 6.15cpe:2.3:o:linux:linux_kernel:6.15:rc3:*:*:*:*:*:*
  • linux linux_kernel 6.15cpe:2.3:o:linux:linux_kernel:6.15:rc4:*:*:*:*:*:*
  • linux linux_kernel 6.15cpe:2.3:o:linux:linux_kernel:6.15:rc5:*:*:*:*:*:*
  • debian debian_linux 11.0cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*

참고 자료 7

링크 내용 불러오는 중…