cve/published/2021/CVE-2021-47515.mbox

From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: <linux-cve-announce@vger.kernel.org>
Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org>
Subject: CVE-2021-47515: seg6: fix the iif in the IPv6 socket control block

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

seg6: fix the iif in the IPv6 socket control block

When an IPv4 packet is received, the ip_rcv_core(...) sets the receiving
interface index into the IPv4 socket control block (v5.16-rc4,
net/ipv4/ip_input.c line 510):

    IPCB(skb)->iif = skb->skb_iif;

If that IPv4 packet is meant to be encapsulated in an outer IPv6+SRH
header, the seg6_do_srh_encap(...) performs the required encapsulation.
In this case, the seg6_do_srh_encap function clears the IPv6 socket control
block (v5.16-rc4 net/ipv6/seg6_iptunnel.c line 163):

    memset(IP6CB(skb), 0, sizeof(*IP6CB(skb)));

The memset(...) was introduced in commit ef489749aae5 ("ipv6: sr: clear
IP6CB(skb) on SRH ip4ip6 encapsulation") a long time ago (2019-01-29).

Since the IPv6 socket control block and the IPv4 socket control block share
the same memory area (skb->cb), the receiving interface index info is lost
(IP6CB(skb)->iif is set to zero).

As a side effect, that condition triggers a NULL pointer dereference if
commit 0857d6f8c759 ("ipv6: When forwarding count rx stats on the orig
netdev") is applied.

To fix that issue, we set the IP6CB(skb)->iif with the index of the
receiving interface once again.

The Linux kernel CVE team has assigned CVE-2021-47515 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 4.14.98 with commit c630ec8bdadae9d557b1ceb9d6c06e149108a0d4 and fixed in 4.14.258 with commit b16d412e5f79734033df04e97d7ea2f50a8e9fe3
	Issue introduced in 4.19.20 with commit 2f704348c93ff8119e642dae6a72327f90b82810 and fixed in 4.19.221 with commit 6431e71093f3da586a00c6d931481ffb0dc2db0e
	Issue introduced in 5.0 with commit ef489749aae508e6f17886775c075f12ff919fb1 and fixed in 5.4.165 with commit ef8804e47c0a44ae106ead1740408af5ea6c6ee9
	Issue introduced in 5.0 with commit ef489749aae508e6f17886775c075f12ff919fb1 and fixed in 5.10.85 with commit 666521b3852d2b2f52d570f9122b1e4b50d96831
	Issue introduced in 5.0 with commit ef489749aae508e6f17886775c075f12ff919fb1 and fixed in 5.15.8 with commit 98adb2bbfa407c9290bda299d4c6f7a1c4ebd5e1
	Issue introduced in 5.0 with commit ef489749aae508e6f17886775c075f12ff919fb1 and fixed in 5.16 with commit ae68d93354e5bf5191ee673982251864ea24dd5c
	Issue introduced in 4.20.7 with commit b71b7e0280f47b4ac633fbfd153423814ea87810

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2021-47515
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/ipv6/seg6_iptunnel.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/b16d412e5f79734033df04e97d7ea2f50a8e9fe3
	https://git.kernel.org/stable/c/6431e71093f3da586a00c6d931481ffb0dc2db0e
	https://git.kernel.org/stable/c/ef8804e47c0a44ae106ead1740408af5ea6c6ee9
	https://git.kernel.org/stable/c/666521b3852d2b2f52d570f9122b1e4b50d96831
	https://git.kernel.org/stable/c/98adb2bbfa407c9290bda299d4c6f7a1c4ebd5e1
	https://git.kernel.org/stable/c/ae68d93354e5bf5191ee673982251864ea24dd5c