In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ipv6: Fix dst leak for uncached routes.<\/p>\n
ip6_route_output_flags(), ip6_rt_put_flags(), and ip6_dst_check()
\ndetect an uncached route by list_empty(&rt->dst.rt_uncached),
\nwhich replaced the static DST_NOCACHE flag check in commit
\na4c2fd7f7891 (“net: remove DST_NOCACHE flag”).<\/p>\n
When a device is unregistered, rt6_uncached_list_flush_dev()
\nunlinks uncached routes tied to the device from rt6_uncached_list.<\/p>\n
Previously, they were moved to another list with list_move()
\n(__list_del_entry() + list_add()), and since commit 98aa546af5e4
\n(“inet: remove (struct uncached_list)->quarantine”), the routes
\nare just unlinked with list_del_init().<\/p>\n
If list_del_init() runs concurrently, list_empty() evaluates to
\ntrue; ip6_route_output_flags() calls dst_hold_safe() incorrectly
\nand ip6_rt_put_flags() skips ip6_rt_put(), leaking dst, and thus
\ndev tied via rt->from as well.<\/p>\n
The same race is partially fixed by commit 9a6f0c4d5796 (“dst:
\nfix races in rt6_uncached_list_del() and rt_del_uncached_list()”).<\/p>\n
Let’s check rt6->dst.rt_uncached_list instead.<\/p>\n
Note that IPv4 does not have the same issue.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ipv6: Fix dst leak for uncached routes.<\/p>\n
ip6_route_output_flags(), ip6_rt_put_flags(), and ip6_dst_check()
\ndetect an uncached route<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-41068","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/41068","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=41068"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=41068"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=41068"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}