In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ipv4: icmp: reject RTN_UNREACHABLE input routes in icmp_route_lookup<\/p>\n
When the forward output route cannot be used in icmp_route_lookup(),
\nit enters the “reverse path” and calls ip_route_input() on fl4_dec.daddr,
\nthe original packet’s source address.<\/p>\n
ip_route_input() only returns an error for truly invalid packets. For
\nunreachable addresses it will succeed and return an input route whose
\ndst.output is set to ip_rt_bug(). The existing check only rejects
\nRTN_LOCAL routes, so the RTN_UNREACHABLE route types can still be returned
\nand later used for output, syzkaller triggering a WARN_ON_ONCE()
\nin ip_rt_bug() as bellow:<\/p>\n
————[ cut here ]————
\n WARNING: net\/ipv4\/route.c:1273 at ip_rt_bug+0x14\/0x20
\n RIP: 0010:ip_rt_bug+0x14\/0x20
\n Call Trace:
\n ip_push_pending_frames+0xfa\/0x100
\n __icmp_send+0x905\/0xf10
\n ip_options_compile+0xc0\/0xd0
\n ip_rcv_finish_core+0x321\/0xae0
\n ip_rcv+0x1de\/0x260
\n __netif_receive_skb_one_core+0x11a\/0x130
\n netif_receive_skb+0x7b\/0x260
\n tun_get_user+0x11bf\/0x1c10
\n ————[ cut here ]————<\/p>\n
Reject input route that is RTN_UNREACHABLE to fix it. The net warning
\nis only printed for RTN_LOCAL, as RTN_UNREACHABLE is not the result of
\na race condition.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ipv4: icmp: reject RTN_UNREACHABLE input routes in icmp_route_lookup<\/p>\n
When the forward output route cannot be used in icmp_route_lo<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-33372","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/33372","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=33372"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=33372"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=33372"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}