In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ipv6: null-check fib6_node before accessing in __ip6_del_rt_siblings()<\/p>\n
syzbot reported a null-ptr-deref in __ip6_del_rt_siblings() [0].<\/p>\n
The stack trace hinted towards a null dereference of rt->fib6_node when
\nfn->leaf is accessed in __ip6_del_rt_siblings(). With
\nRTNL_FLAG_DOIT_UNLOCKED set, inet6_rtm_delroute() operations run
\nconcurrently without acquiring the RTNL lock. In ip6_route_del(), the
\nroute lookup happens under rcu_read_lock() without acquiring
\ntable->tb6_lock.<\/p>\n
Between ip6_route_del() looking up the route and __ip6_del_rt_siblings()
\nacquiring table->tb6_lock, another thread can modify the routing table.
\nFor example, when an ECMP route is replaced via RTM_NEWROUTE with
\nNLM_F_REPLACE, fib6_add_rt2node() unlinks all old siblings and sets
\niter->fib6_node = NULL. A reproducer was found that triggers this [1].<\/p>\n
Add a check to ensure rt->fib6_node is non-null before accessing it.<\/p>\n
[0]
\nKASAN: null-ptr-deref in range [0x0000000000000020-0x0000000000000027]
\nRIP: 0010:__ip6_del_rt_siblings+0x31e\/0x7c0 net\/ipv6\/route.c:4056
\nCall Trace:<\/p>\n
ip6_route_del+0x1054\/0x1110 net\/ipv6\/route.c:4232
\n inet6_rtm_delroute+0x5d7\/0x6d0 net\/ipv6\/route.c:5669
\n rtnetlink_rcv_msg+0x802\/0xc00 net\/core\/rtnetlink.c:7132
\n netlink_rcv_skb+0x226\/0x4a0 net\/netlink\/af_netlink.c:2556
\n netlink_unicast_kernel net\/netlink\/af_netlink.c:1319 [inline]
\n netlink_unicast+0x7f5\/0x990 net\/netlink\/af_netlink.c:1345
\n netlink_sendmsg+0x813\/0xb40 net\/netlink\/af_netlink.c:1900
\n sock_sendmsg_nosec+0x13a\/0x180 net\/socket.c:800
\n __sock_sendmsg net\/socket.c:815 [inline]
\n ____sys_sendmsg+0x565\/0x870 net\/socket.c:2713
\n ___sys_sendmsg+0x2a5\/0x360 net\/socket.c:2767
\n __sys_sendmsg net\/socket.c:2799 [inline]
\n __do_sys_sendmsg net\/socket.c:2804 [inline]
\n __se_sys_sendmsg net\/socket.c:2802 [inline]
\n __x64_sys_sendmsg+0x1b7\/0x290 net\/socket.c:2802
\n do_syscall_x64 arch\/x86\/entry\/syscall_64.c:61 [inline]
\n do_syscall_64+0x166\/0x520 arch\/x86\/entry\/syscall_64.c:84
\n entry_SYSCALL_64_after_hwframe+0x77\/0x7f<\/p>\n
[1] https:\/\/gist.github.com\/NamanGulati\/0766a1159b6ca61928faaf87425ff899<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ipv6: null-check fib6_node before accessing in __ip6_del_rt_siblings()<\/p>\n
syzbot reported a null-ptr-deref in __ip6_del_rt_siblings()<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-29130","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/29130","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=29130"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=29130"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=29130"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}