CVE-2020-10136

A flaw was found in the IP-in-IP protocol. An unauthenticated attacker can use the IP-in-IP protocol to route network traffic through a vulnerable device, which can lead to spoofing, access control bypasses, and other unexpected network behaviors.

Mitigation

Systems that have IP in IP kernel modules loaded will need to unload the "ipip" kernel module and blacklist it to prevent the module from being used a fix has been provided ( See <https://access.redhat.com/solutions/41278&gt; for a guide on how to blacklist modules).

Take careful consideration that if unloading and blacklisting the module, this may create a one-time attack vector window for a local attacker.

Consider using an alternative authenticated and encrypted tunnelling protocol until a suitable solution is developed.