Описание
A flaw was found in the Linux kernel's IPv6 networking component. A null pointer dereference vulnerability exists in the fib6_nh_mtu_change() function. This can occur when the idev (in6_device) pointer is cleared during network interface shutdown, but the fib6_nh_mtu_change() function attempts to dereference it without a proper null check. An attacker could potentially trigger this condition, leading to a kernel crash and a Denial of Service (DoS).
Отчет
A flaw was found in the Linux kernel IPv6 routing implementation. The fib6_nh_mtu_change() function re-fetches the associated inet6_dev (idev) pointer via __in6_dev_get() and dereferences idev->cnf.mtu6 without a NULL check. When a network interface is brought down, addrconf_ifdown() clears the device IPv6 pointer (dev->ip6_ptr) while nexthop-backed routes can still reference the interface during the teardown window. If an incoming ICMPv6 Router Advertisement drives an MTU update on one of these routes, via icmpv6_rcv(), ndisc_router_discovery(), and rt6_mtu_change(), while the interface teardown race is in progress, fib6_nh_mtu_change() can observe a NULL idev and crash. This is classified as CWE-476 (NULL Pointer Dereference) and results in a kernel oops or crash, a denial of service only. There is no confidentiality or integrity impact, since the fault occurs on a NULL pointer read with no further data exposure or corruption. Triggering the flaw requires an attacker on the same local network segment (adjacent) sending ICMPv6 Router Advertisement traffic while the target interface happens to be undergoing teardown, a timing condition outside the attacker's control. Fixed upstream in the Linux kernel via commit 46c3b8191aad3d032776bf3bebf03efdf5f4b905.
Меры по смягчению последствий
There is no mitigation for this issue other than applying the fix. Exploitation requires an attacker on the same local network segment as the target, and requires a network interface carrying nexthop-backed IPv6 routes to be undergoing teardown at the same time an ICMPv6 Router Advertisement is processed against it, a race window that is not reliably controllable by an attacker.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 10 | libkrun | Fix deferred | ||
| Red Hat Enterprise Linux 6 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 7 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 9 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 9 | kernel-rt | Fix deferred | ||
| Red Hat Enterprise Linux for NVIDIA 26 | kernel | Fix deferred |
Показывать по
Дополнительная информация
Статус:
EPSS
5.3 Medium
CVSS3
Связанные уязвимости
In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix null-ptr-deref in fib6_nh_mtu_change(). fib6_nh_mtu_change() re-fetches idev via __in6_dev_get(arg->dev) and dereferences idev->cnf.mtu6 without a NULL check. addrconf_ifdown() clears dev->ip6_ptr with RCU_INIT_POINTER() after rt6_disable_ip() has released tb6_lock, so the RA-driven MTU walk can observe a NULL idev and oops. The caller rt6_mtu_change_route() guards its own __in6_dev_get(), but this re-fetch is unguarded; nexthop-backed routes survive addrconf_ifdown()'s flush, so the walk still reaches it after ip6_ptr is nulled. Return 0 when idev is NULL, matching rt6_mtu_change_route() and the fib6_mtu() fix in commit 5ad509c1fdad ("ipv6: Fix null-ptr-deref in fib6_mtu()."). Oops: general protection fault, ... KASAN: null-ptr-deref in range [0x00000000000002a8-0x00000000000002af] RIP: 0010:fib6_nh_mtu_change+0x203/0x990 rt6_mtu_change_route+0x141/0x1d0 __fib6_clean_all+0xd0/0x160 rt6_mtu_change+0xb4/0x1...
In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix null-ptr-deref in fib6_nh_mtu_change(). fib6_nh_mtu_change() re-fetches idev via __in6_dev_get(arg->dev) and dereferences idev->cnf.mtu6 without a NULL check. addrconf_ifdown() clears dev->ip6_ptr with RCU_INIT_POINTER() after rt6_disable_ip() has released tb6_lock, so the RA-driven MTU walk can observe a NULL idev and oops. The caller rt6_mtu_change_route() guards its own __in6_dev_get(), but this re-fetch is unguarded; nexthop-backed routes survive addrconf_ifdown()'s flush, so the walk still reaches it after ip6_ptr is nulled. Return 0 when idev is NULL, matching rt6_mtu_change_route() and the fib6_mtu() fix in commit 5ad509c1fdad ("ipv6: Fix null-ptr-deref in fib6_mtu()."). Oops: general protection fault, ... KASAN: null-ptr-deref in range [0x00000000000002a8-0x00000000000002af] RIP: 0010:fib6_nh_mtu_change+0x203/0x990 rt6_mtu_change_route+0x141/0x1d0 __fib6_clean_all+0xd0/0x160 r
In the Linux kernel, the following vulnerability has been resolved: i ...
In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix null-ptr-deref in fib6_nh_mtu_change(). fib6_nh_mtu_change() re-fetches idev via __in6_dev_get(arg->dev) and dereferences idev->cnf.mtu6 without a NULL check. addrconf_ifdown() clears dev->ip6_ptr with RCU_INIT_POINTER() after rt6_disable_ip() has released tb6_lock, so the RA-driven MTU walk can observe a NULL idev and oops. The caller rt6_mtu_change_route() guards its own __in6_dev_get(), but this re-fetch is unguarded; nexthop-backed routes survive addrconf_ifdown()'s flush, so the walk still reaches it after ip6_ptr is nulled. Return 0 when idev is NULL, matching rt6_mtu_change_route() and the fib6_mtu() fix in commit 5ad509c1fdad ("ipv6: Fix null-ptr-deref in fib6_mtu()."). Oops: general protection fault, ... KASAN: null-ptr-deref in range [0x00000000000002a8-0x00000000000002af] RIP: 0010:fib6_nh_mtu_change+0x203/0x990 rt6_mtu_change_route+0x141/0x1d0 __fib6_clean_all+0xd0/0x160 ...
EPSS
5.3 Medium
CVSS3