In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
netfilter: ip6t_rpfilter: reject routes without inet6_dev<\/p>\n
ip6_route_lookup() can return an error-free route whose rt6i_idev is
\nNULL. Lowering an external nexthop device’s MTU below IPV6_MIN_MTU tears
\ndown its inet6_dev while fib6_ifdown() leaves routes using nexthop objects
\nin the FIB. An unprivileged user can construct this state with rtnetlink
\nin a private user and network namespace, then trigger a NULL dereference
\nthrough an IPv6 rpfilter lookup:<\/p>\n
Oops: general protection fault, probably for non-canonical address
\n 0xdffffc0000000000
\n KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
\n RIP: rpfilter_mt (net\/ipv6\/netfilter\/ip6t_rpfilter.c:75)
\n Call Trace:
\n ip6t_do_table (net\/ipv6\/netfilter\/ip6_tables.c:316)
\n nf_hook_slow (net\/netfilter\/core.c:619)
\n ipv6_rcv (net\/ipv6\/ip6_input.c:351)
\n __netif_receive_skb_one_core (net\/core\/dev.c:6216)
\n process_backlog (net\/core\/dev.c:6680)
\n __napi_poll (net\/core\/dev.c:7739)
\n net_rx_action (net\/core\/dev.c:7959)
\n handle_softirqs (kernel\/softirq.c:622)
\n do_softirq.part.0 (kernel\/softirq.c:523)
\n __local_bh_enable_ip (kernel\/softirq.c:450)
\n __dev_queue_xmit (net\/core\/dev.c:4913)
\n packet_sendmsg (net\/packet\/af_packet.c:3139)
\n __sys_sendto (net\/socket.c:2252)
\n __x64_sys_sendto (net\/socket.c:2259)
\n do_syscall_64 (arch\/x86\/entry\/syscall_64.c:94)
\n entry_SYSCALL_64_after_hwframe (arch\/x86\/entry\/entry_64.S:121)
\n Kernel panic – not syncing: Fatal exception in interrupt<\/p>\n
Reject routes without an inet6_dev immediately after lookup. Such routes
\nare not eligible for reverse-path filtering, and the check protects all
\nlater rt6i_idev dereferences.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
netfilter: ip6t_rpfilter: reject routes without inet6_dev<\/p>\n
ip6_route_lookup() can return an error-free route whose rt6i_idev is
\nNUL<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-34942","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/34942","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=34942"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=34942"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=34942"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}