ipv6: Fix signed integer overflow in l2tp_ip6_sendmsg

Vulnerability

A signed integer overflow exists in the l2tp_ip6_sendmsg function in the Linux kernel's IPv6 L2TP implementation. When the len parameter is greater than or equal to INT_MAX - transhdrlen, the calculation ulen = len + transhdrlen overflows, resulting in a small positive or negative value. This can lead to incorrect memory allocation and subsequent buffer overflow. The affected versions are those prior to the fix commits [1] and [2].

Exploitation

An attacker would need to be able to send L2TP packets over IPv6, which typically requires local user access or the ability to create raw sockets. The attacker would craft a message with a length that triggers the overflow, causing the kernel to allocate an undersized buffer and then copy more data than allocated, leading to memory corruption.

Impact

Successful exploitation could result in a denial of service (system crash) or, if carefully controlled, arbitrary code execution in kernel context. The exact impact depends on the memory layout and the attacker's ability to control the overflowed data.

Mitigation

The fix was applied in the Linux kernel stable branches via commits [1] and [2]. Users should update to a kernel version containing these commits. No workaround is available; the only mitigation is to apply the patch.