[BUG] net/sched: act_ife reads stale tailroom from short egress skbs

[shaos]

Hello,

A UID 60000 victim in one network namespace sends an 11-byte random marker through an IFE encode action and releases its skb. A UID 65534 attacker in a separate user/network namespace then sends a one-byte TUN packet through mirred to loopback egress. The egress IFE action copies ETH_HLEN bytes from skb->data without checking skb->len, and the emitted frame contains the victim's marker in the stale tailroom.

HEAD commit:    c03c1a14507dfaf8b856c2608f9ac216021fc222
git tree:       30fd2ef82912c26cf3a58ad0ba6afc375fa851ac
source version: Linux 7.3.0, local master
compiler:       gcc 11.4.0, GNU ld 2.38

console output:
https://gist.githubusercontent.com/shaos26/3961afdf0773e9f65bdfe152e05356da/raw/65466e4e5bd3843400c036ba31c64108ae4d57e4/console-output.txt
kernel config:
https://gist.githubusercontent.com/shaos26/3961afdf0773e9f65bdfe152e05356da/raw/7d8abdee14fcf83f61e27fce20dee98b4bccea8c/kernel-config.txt
reproducer:
https://gist.githubusercontent.com/shaos26/82ce293b417cd5a2d19c0978d562bc1c/raw/b65492b33b91aad0479423ccf92d2910c1c9d656/poc.c

Build the tested kernel with the attached configuration, compile the reproducer statically, and boot a disposable QEMU guest with TUN, veth, mirred, IFE and packet-socket support. The test uses separate victim and attacker network namespaces.

Impact and prerequisites:
The attacker recovered 11 bytes from a random marker generated by a different UID in another network namespace. This is a cross-principal kernel-memory disclosure through an emitted frame, reachable with namespace-scoped CAP_NET_ADMIN and CAP_NET_RAW when user/network namespaces and TUN are available. No arbitrary-address read or privilege escalation is demonstrated.

Validation: Two fresh QEMU boots recovered different victim markers byte-for-byte. The no-prime control did not recover the victim marker.

Thanks,

shaos