In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ipv6: ioam: fix type confusion of dst_entry<\/p>\n
IOAM uses a dummy dst_entry(null_dst) to mark that the destination should
\nnot be changed after the transformation. This dst is stored in the IOAM lwt
\nstate and may be passed to dst_cache_set_ip6().<\/p>\n
However, the IPv6 dst cache path eventually calls rt6_get_cookie(), which
\ntreats the dst_entry as part of a struct rt6_info. Since the null_dst was
\nembedded directly as a struct dst_entry in struct ioam6_lwt, this resulted
\nin an invalid cast and rt6_get_cookie() reading fields from the wrong
\nobject.<\/p>\n
In practice, the wrong cookie is not used while dst->obsolete is zero, but
\nrt6_get_cookie() may also access per-cpu value when rt->sernum is
\nzero. In this case, rt->sernum aliases ioam6_lwt::cache::reset_ts, which
\ncan become zero, making this a potential invalid pointer access.<\/p>\n
Fix this by embedding a full struct rt6_info for the dummy IPv6 route and
\npassing its dst member to the dst APIs.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ipv6: ioam: fix type confusion of dst_entry<\/p>\n
IOAM uses a dummy dst_entry(null_dst) to mark that the destination should
\nnot be chang<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-7089","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/7089","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=7089"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=7089"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=7089"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}