In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ip6mr: do not clone dst in ip6mr_cache_report()<\/p>\n
IPv6 input attaches a non-refcounted (NOREF) dst to skbs under RCU.
\nWhen an ingress multicast packet misses MFC lookup,
\nip6mr_cache_unresolved() places the skb onto the unresolved queue,
\nescaping the receive-side RCU grace period.<\/p>\n
If the underlying route is deleted and freed, and the MFC queue is later
\nresolved with a wrong parent interface, ip6_mr_forward() invokes
\nip6mr_cache_report(…, MRT6MSG_WRONGMIF), which executes
\ndst_clone(skb_dst(pkt)) on the freed dst entry, triggering a slab
\nuse-after-free.<\/p>\n
Report packets queued to mroute6_sk (a raw socket) and netlink
\nnotifications do not require an attached dst entry.<\/p>\n
Fix this by:
\n1. Removing dst_clone() in ip6mr_cache_report() and ensuring report skbs
\n do not hold a dst.
\n2. Dropping skb_dst before queuing unresolved skbs in
\n ip6mr_cache_unresolved(), matching the fact that multicast
\n forwarding resolves outgoing routes anew via ip6_route_output().<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ip6mr: do not clone dst in ip6mr_cache_report()<\/p>\n
IPv6 input attaches a non-refcounted (NOREF) dst to skbs under RCU.
\nWhen an ingres<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-25520","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/25520","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=25520"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=25520"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=25520"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}