Description

In the Linux kernel, the following vulnerability has been resolved: ipv6: fix possible race in __fib6_drop_pcpu_from() syzbot found a race in __fib6_drop_pcpu_from() [1] If compiler reads more than once (*ppcpu_rt), second read could read NULL, if another cpu clears the value in rt6_get_pcpu_route(). Add a READ_ONCE() to prevent this race. Also add rcu_read_lock()/rcu_read_unlock() because we rely on RCU protection while dereferencing pcpu_rt. [1] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000012: 0000 [#1] PREEMPT SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000090-0x0000000000000097] CPU: 0 PID: 7543 Comm: kworker/u8:17 Not tainted 6.10.0-rc1-syzkaller-00013-g2bfcfd584ff5 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024 Workqueue: netns cleanup_net RIP: 0010:__fib6_drop_pcpu_from.part.0+0x10a/0x370 net/ipv6/ip6_fib.c:984 Code: f8 48 c1 e8 03 80 3c 28 00 0f 85 16 02 00 00 4d 8b 3f 4d 85 ff 74 31 e8 74 a7 fa f7 49 8d bf 90 00 00 00 48 89 f8 48 c1 e8 03 <80> 3c 28 00 0f 85 1e 02 00 00 49 8b 87 90 00 00 00 48 8b 0c 24 48 RSP: 0018:ffffc900040df070 EFLAGS: 00010206 RAX: 0000000000000012 RBX: 0000000000000001 RCX: ffffffff89932e16 RDX: ffff888049dd1e00 RSI: ffffffff89932d7c RDI: 0000000000000091 RBP: dffffc0000000000 R08: 0000000000000005 R09: 0000000000000007 R10: 0000000000000001 R11: 0000000000000006 R12: ffff88807fa080b8 R13: fffffbfff1a9a07d R14: ffffed100ff41022 R15: 0000000000000001 FS: 0000000000000000(0000) GS:ffff8880b9200000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000001b32c26000 CR3: 000000005d56e000 CR4: 00000000003526f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> __fib6_drop_pcpu_from net/ipv6/ip6_fib.c:966 [inline] fib6_drop_pcpu_from net/ipv6/ip6_fib.c:1027 [inline] fib6_purge_rt+0x7f2/0x9f0 net/ipv6/ip6_fib.c:1038 fib6_del_route net/ipv6/ip6_fib.c:1998 [inline] fib6_del+0xa70/0x17b0 net/ipv6/ip6_fib.c:2043 fib6_clean_node+0x426/0x5b0 net/ipv6/ip6_fib.c:2205 fib6_walk_continue+0x44f/0x8d0 net/ipv6/ip6_fib.c:2127 fib6_walk+0x182/0x370 net/ipv6/ip6_fib.c:2175 fib6_clean_tree+0xd7/0x120 net/ipv6/ip6_fib.c:2255 __fib6_clean_all+0x100/0x2d0 net/ipv6/ip6_fib.c:2271 rt6_sync_down_dev net/ipv6/route.c:4906 [inline] rt6_disable_ip+0x7ed/0xa00 net/ipv6/route.c:4911 addrconf_ifdown.isra.0+0x117/0x1b40 net/ipv6/addrconf.c:3855 addrconf_notify+0x223/0x19e0 net/ipv6/addrconf.c:3778 notifier_call_chain+0xb9/0x410 kernel/notifier.c:93 call_netdevice_notifiers_info+0xbe/0x140 net/core/dev.c:1992 call_netdevice_notifiers_extack net/core/dev.c:2030 [inline] call_netdevice_notifiers net/core/dev.c:2044 [inline] dev_close_many+0x333/0x6a0 net/core/dev.c:1585 unregister_netdevice_many_notify+0x46d/0x19f0 net/core/dev.c:11193 unregister_netdevice_many net/core/dev.c:11276 [inline] default_device_exit_batch+0x85b/0xae0 net/core/dev.c:11759 ops_exit_list+0x128/0x180 net/core/net_namespace.c:178 cleanup_net+0x5b7/0xbf0 net/core/net_namespace.c:640 process_one_work+0x9fb/0x1b60 kernel/workqueue.c:3231 process_scheduled_works kernel/workqueue.c:3312 [inline] worker_thread+0x6c8/0xf70 kernel/workqueue.c:3393 kthread+0x2c1/0x3a0 kernel/kthread.c:389 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

Metrics

 

CVSS Version 4.0 CVSS Version 3.x CVSS Version 2.0

NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed.

CVSS 4.0 Severity and Vector Strings:

NIST: NVD

N/A

NVD assessment not yet provided.

CVSS 3.x Severity and Vector Strings:

NIST: NVD

Base Score:  4.7 MEDIUM

Vector:  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

CVSS 2.0 Severity and Vector Strings:

NIST: NVD

Base Score: N/A

NVD assessment not yet provided.

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

Hyperlink	Resource
https://git.kernel.org/stable/c/09e5a5a80e205922151136069e440477d6816914	Patch
https://git.kernel.org/stable/c/2498960dac9b6fc49b6d1574f7cd1a4872744adf	Patch
https://git.kernel.org/stable/c/7e796c3fefa8b17b30e7252886ae8cffacd2b9ef	Patch
https://git.kernel.org/stable/c/a0bc020592b54a8f3fa2b7f244b6e39e526c2e12	Patch
https://git.kernel.org/stable/c/b01e1c030770ff3b4fe37fc7cc6bca03f594133f	Patch
https://git.kernel.org/stable/c/c693698787660c97950bc1f93a8dd19d8307153d	Patch
https://git.kernel.org/stable/c/c90af1cced2f669a7b2304584be4ada495eaa0e5	Patch

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-476	NULL Pointer Dereference	NIST

Known Affected Software Configurations Switch to CPE 2.2

CPEs loading, please wait.

Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.

Change History

2 change records found show changes

Initial Analysis by NIST 9/19/2024 9:16:03 AM

Action	Type	Old Value	New Value
Added	CPE Configuration		Record truncated, showing 500 of 756 characters. View Entire Change Record OR *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 4.2 up to (excluding) 5.4.279 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.5 up to (excluding) 5.10.221 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.11 up to (excluding) 5.15.162 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.16 up to (excluding) 6.1.95 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (
Added	CVSS V3.1		NIST AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Added	CWE		NIST CWE-476
Changed	Reference Type	https://git.kernel.org/stable/c/09e5a5a80e205922151136069e440477d6816914 No Types Assigned	https://git.kernel.org/stable/c/09e5a5a80e205922151136069e440477d6816914 Patch
Changed	Reference Type	https://git.kernel.org/stable/c/2498960dac9b6fc49b6d1574f7cd1a4872744adf No Types Assigned	https://git.kernel.org/stable/c/2498960dac9b6fc49b6d1574f7cd1a4872744adf Patch
Changed	Reference Type	https://git.kernel.org/stable/c/7e796c3fefa8b17b30e7252886ae8cffacd2b9ef No Types Assigned	https://git.kernel.org/stable/c/7e796c3fefa8b17b30e7252886ae8cffacd2b9ef Patch
Changed	Reference Type	https://git.kernel.org/stable/c/a0bc020592b54a8f3fa2b7f244b6e39e526c2e12 No Types Assigned	https://git.kernel.org/stable/c/a0bc020592b54a8f3fa2b7f244b6e39e526c2e12 Patch
Changed	Reference Type	https://git.kernel.org/stable/c/b01e1c030770ff3b4fe37fc7cc6bca03f594133f No Types Assigned	https://git.kernel.org/stable/c/b01e1c030770ff3b4fe37fc7cc6bca03f594133f Patch
Changed	Reference Type	https://git.kernel.org/stable/c/c693698787660c97950bc1f93a8dd19d8307153d No Types Assigned	https://git.kernel.org/stable/c/c693698787660c97950bc1f93a8dd19d8307153d Patch
Changed	Reference Type	https://git.kernel.org/stable/c/c90af1cced2f669a7b2304584be4ada495eaa0e5 No Types Assigned	https://git.kernel.org/stable/c/c90af1cced2f669a7b2304584be4ada495eaa0e5 Patch

New CVE Received by NIST 7/12/2024 9:15:13 AM

Action	Type	Old Value	New Value
Added	Description		Record truncated, showing 500 of 3514 characters. View Entire Change Record In the Linux kernel, the following vulnerability has been resolved: ipv6: fix possible race in __fib6_drop_pcpu_from() syzbot found a race in __fib6_drop_pcpu_from() [1] If compiler reads more than once (*ppcpu_rt), second read could read NULL, if another cpu clears the value in rt6_get_pcpu_route(). Add a READ_ONCE() to prevent this race. Also add rcu_read_lock()/rcu_read_unlock() because we rely on RCU protection while dereferencing pcpu_rt. [1] Oops: general protection fault, probably
Added	Reference		kernel.org https://git.kernel.org/stable/c/09e5a5a80e205922151136069e440477d6816914 [No types assigned]
Added	Reference		kernel.org https://git.kernel.org/stable/c/2498960dac9b6fc49b6d1574f7cd1a4872744adf [No types assigned]
Added	Reference		kernel.org https://git.kernel.org/stable/c/7e796c3fefa8b17b30e7252886ae8cffacd2b9ef [No types assigned]
Added	Reference		kernel.org https://git.kernel.org/stable/c/a0bc020592b54a8f3fa2b7f244b6e39e526c2e12 [No types assigned]
Added	Reference		kernel.org https://git.kernel.org/stable/c/b01e1c030770ff3b4fe37fc7cc6bca03f594133f [No types assigned]
Added	Reference		kernel.org https://git.kernel.org/stable/c/c693698787660c97950bc1f93a8dd19d8307153d [No types assigned]
Added	Reference		kernel.org https://git.kernel.org/stable/c/c90af1cced2f669a7b2304584be4ada495eaa0e5 [No types assigned]