In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ipv6: rpl: fix NULL dereference of idev in ipv6_rpl_srh_rcv()<\/p>\n
ipv6_rpl_srh_rcv() dereferences idev from __in6_dev_get() without a NULL
\ncheck when reading idev->cnf.rpl_seg_enabled.<\/p>\n
When the device’s MTU drops below IPV6_MIN_MTU, addrconf_ifdown() clears
\ndev->ip6_ptr through RCU_INIT_POINTER(). A packet that passed the idev
\ncheck in ip6_rcv_core() can then reach ipv6_rpl_srh_rcv() with
\ndev->ip6_ptr already NULL.<\/p>\n
Reproduced by flooding the receiving interface with ping6 traffic while
\nflapping its MTU between 1500 and 1200:<\/p>\n
BUG: KASAN: null-ptr-deref in ipv6_rpl_srh_rcv+0xb3\/0x1070
\n Read of size 4 at addr 00000000000006b4 by task ping6\/394<\/p>\n
CPU: 2 UID: 0 PID: 394 Comm: ping6 Not tainted 7.2.0-rc7-micro-vm-dev-00095-g24ef02f934ee #240 PREEMPT(full)
\n Call Trace:<\/p>\n
kasan_report+0xc6\/0x100
\n ipv6_rpl_srh_rcv+0xb3\/0x1070
\n ip6_protocol_deliver_rcu+0x759\/0x9a0
\n ip6_input_finish+0xa8\/0x1b0
\n ip6_input+0xe1\/0x490
\n ipv6_rcv+0x33d\/0x460
\n __netif_receive_skb_one_core+0xd6\/0x130
\n process_backlog+0x2cc\/0xa00
\n __napi_poll.constprop.0+0x56\/0x270
\n net_rx_action+0x327\/0x730
\n handle_softirqs+0x11e\/0x630
\n do_softirq+0xb3\/0xf0<\/p>\n
Both ipv6_rpl_srh_rcv() and ipv6_srh_rcv() are called only from
\nipv6_rthdr_rcv(), which already has an idev lookup.<\/p>\n
Fix the NULL dereference on the RPL path by checking idev in
\nipv6_rthdr_rcv(), before it calls either function. The callees take idev as
\nan argument and no longer call __in6_dev_get(), so the packet is now
\ndropped in one place, with SKB_DROP_REASON_IPV6DISABLED on both paths.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ipv6: rpl: fix NULL dereference of idev in ipv6_rpl_srh_rcv()<\/p>\n
ipv6_rpl_srh_rcv() dereferences idev from __in6_dev_get() without a <\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-21483","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/21483","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=21483"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=21483"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=21483"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}