Описание
In the Linux kernel, the following vulnerability has been resolved:
ipv6: guard against possible NULL deref in __in6_dev_stats_get()
dev_get_by_index_rcu() could return NULL if the original physical
device is unregistered.
Found by Sashiko.
A flaw was found in the Linux kernel's IPv6 component. This vulnerability arises when the dev_get_by_index_rcu() function returns a null value if the original physical device is unregistered, leading to a NULL pointer dereference in __in6_dev_stats_get(). A local attacker could exploit this flaw to trigger a system crash, resulting in a Denial of Service (DoS).
Отчет
A MODERATE-impact NULL pointer dereference flaw was found in the Linux kernel's IPv6 statistics path, affecting the kernel and kernel-rt packages in Red Hat Enterprise Linux 9 and 10 as well as Red Hat In-Vehicle OS. In __in6_dev_stats_get(), the pointer returned by dev_get_by_index_rcu() is used without checking for NULL; when the original physical network device is unregistered, dev_get_by_index_rcu() returns NULL, causing a kernel panic. A local attacker able to trigger this condition could crash the system, resulting in a denial of service; there is no impact to confidentiality or integrity. Red Hat Enterprise Linux 7 and 8 are not affected because the vulnerable code is not present in those releases, and the assessment for Red Hat Enterprise Linux 6 Extended Lifecycle Support is still in progress. The fix for the affected Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 10, and Red Hat In-Vehicle OS streams is currently deferred, so the vulnerable code remains in shipped kernels; the residual risk is limited to local denial of service. The upstream CVE record assigns a CVSS 3.1 score of 7.5 (Important) with a network attack vector, while Red Hat rates this flaw 5.5 (Moderate) with a local attack vector and low privileges required, reflecting that triggering the crash requires local access on the affected system.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 6 | kernel | Out of support scope | ||
| Red Hat Enterprise Linux 7 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 9 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 9 | kernel-rt | Fix deferred |
Показывать по
Дополнительная информация
Статус:
EPSS
5.5 Medium
CVSS3
Связанные уязвимости
In the Linux kernel, the following vulnerability has been resolved: ipv6: guard against possible NULL deref in __in6_dev_stats_get() dev_get_by_index_rcu() could return NULL if the original physical device is unregistered. Found by Sashiko.
In the Linux kernel, the following vulnerability has been resolved: ipv6: guard against possible NULL deref in __in6_dev_stats_get() dev_get_by_index_rcu() could return NULL if the original physical device is unregistered. Found by Sashiko.
In the Linux kernel, the following vulnerability has been resolved: i ...
EPSS
5.5 Medium
CVSS3