Loading vulnerability…
Linux kernel Geneve/IPsec Cleartext Traffic Exposure
CVE-2020-25645 is a flaw in Linux kernel versions before 5.9-rc7 affecting the interaction between Geneve tunneling and IPsec. When IPsec policy is configured to encrypt only the UDP port used by a Geneve tunnel, the kernel may route encapsulated tunnel traffic outside the intended IPsec-protected path. As a result, traffic exchanged between Geneve endpoints can be transmitted in cleartext despite the configured IPsec policy.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An on-path attacker able to observe traffic between the affected Geneve endpoints can read tunnel traffic that was expected to be protected by IPsec. The documented impact is loss of confidentiality; integrity and availability impacts are not described.
If you can’t patch tonight, do this now.
Configure IPsec to protect all traffic between the Geneve tunnel endpoints rather than matching only the Geneve UDP port. Where Geneve is not required, disable it by unloading and blacklisting the Geneve kernel module.
Patch, then assume compromise.
Install a vendor-provided kernel update containing the upstream fix, then reboot to run the updated kernel. Red Hat remediated supported RHEL 7 kernel packages in RHSA-2021:0856, RHEL 7 kernel-rt packages in RHSA-2021:0857, and RHEL 8 kernel packages in RHSA-2021:1578. Fedora resolved the issue in stable kernel version 5.8.12. RHEL 7 kernel-alt was designated will not fix, and RHEL 8 kernel-rt was reported as affected; use a supported fixed kernel stream where available.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.