cve/published/2024/CVE-2024-36902.mbox

From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: <linux-cve-announce@vger.kernel.org>
Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org>
Subject: CVE-2024-36902: ipv6: fib6_rules: avoid possible NULL dereference in fib6_rule_action()

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

ipv6: fib6_rules: avoid possible NULL dereference in fib6_rule_action()

syzbot is able to trigger the following crash [1],
caused by unsafe ip6_dst_idev() use.

Indeed ip6_dst_idev() can return NULL, and must always be checked.

[1]

Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN PTI
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
CPU: 0 PID: 31648 Comm: syz-executor.0 Not tainted 6.9.0-rc4-next-20240417-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
 RIP: 0010:__fib6_rule_action net/ipv6/fib6_rules.c:237 [inline]
 RIP: 0010:fib6_rule_action+0x241/0x7b0 net/ipv6/fib6_rules.c:267
Code: 02 00 00 49 8d 9f d8 00 00 00 48 89 d8 48 c1 e8 03 42 80 3c 20 00 74 08 48 89 df e8 f9 32 bf f7 48 8b 1b 48 89 d8 48 c1 e8 03 <42> 80 3c 20 00 74 08 48 89 df e8 e0 32 bf f7 4c 8b 03 48 89 ef 4c
RSP: 0018:ffffc9000fc1f2f0 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 1a772f98c8186700
RDX: 0000000000000003 RSI: ffffffff8bcac4e0 RDI: ffffffff8c1f9760
RBP: ffff8880673fb980 R08: ffffffff8fac15ef R09: 1ffffffff1f582bd
R10: dffffc0000000000 R11: fffffbfff1f582be R12: dffffc0000000000
R13: 0000000000000080 R14: ffff888076509000 R15: ffff88807a029a00
FS:  00007f55e82ca6c0(0000) GS:ffff8880b9400000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b31d23000 CR3: 0000000022b66000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
  fib_rules_lookup+0x62c/0xdb0 net/core/fib_rules.c:317
  fib6_rule_lookup+0x1fd/0x790 net/ipv6/fib6_rules.c:108
  ip6_route_output_flags_noref net/ipv6/route.c:2637 [inline]
  ip6_route_output_flags+0x38e/0x610 net/ipv6/route.c:2649
  ip6_route_output include/net/ip6_route.h:93 [inline]
  ip6_dst_lookup_tail+0x189/0x11a0 net/ipv6/ip6_output.c:1120
  ip6_dst_lookup_flow+0xb9/0x180 net/ipv6/ip6_output.c:1250
  sctp_v6_get_dst+0x792/0x1e20 net/sctp/ipv6.c:326
  sctp_transport_route+0x12c/0x2e0 net/sctp/transport.c:455
  sctp_assoc_add_peer+0x614/0x15c0 net/sctp/associola.c:662
  sctp_connect_new_asoc+0x31d/0x6c0 net/sctp/socket.c:1099
  __sctp_connect+0x66d/0xe30 net/sctp/socket.c:1197
  sctp_connect net/sctp/socket.c:4819 [inline]
  sctp_inet_connect+0x149/0x1f0 net/sctp/socket.c:4834
  __sys_connect_file net/socket.c:2048 [inline]
  __sys_connect+0x2df/0x310 net/socket.c:2065
  __do_sys_connect net/socket.c:2075 [inline]
  __se_sys_connect net/socket.c:2072 [inline]
  __x64_sys_connect+0x7a/0x90 net/socket.c:2072
  do_syscall_x64 arch/x86/entry/common.c:52 [inline]
  do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

The Linux kernel CVE team has assigned CVE-2024-36902 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 2.6.26 with commit 5e5f3f0f801321078c897a5de0b4b4304f234da0 and fixed in 4.19.314 with commit 4a5a573387da6a6b23a4cc62147453ff1bc32afa
	Issue introduced in 2.6.26 with commit 5e5f3f0f801321078c897a5de0b4b4304f234da0 and fixed in 5.4.276 with commit ddec23f206a944c73bcc2724358b85388837daff
	Issue introduced in 2.6.26 with commit 5e5f3f0f801321078c897a5de0b4b4304f234da0 and fixed in 5.10.217 with commit 674c951ab8a23f7aff9b4c3f2f865901bc76a290
	Issue introduced in 2.6.26 with commit 5e5f3f0f801321078c897a5de0b4b4304f234da0 and fixed in 5.15.159 with commit 35297fc68de36826087e976f86a5b1f94fd0bf95
	Issue introduced in 2.6.26 with commit 5e5f3f0f801321078c897a5de0b4b4304f234da0 and fixed in 6.1.91 with commit 7e3242c139c38e60844638e394c2877b16b396b0
	Issue introduced in 2.6.26 with commit 5e5f3f0f801321078c897a5de0b4b4304f234da0 and fixed in 6.6.31 with commit 8745a8d74ba17dafe72b6ab461fa6c007d879747
	Issue introduced in 2.6.26 with commit 5e5f3f0f801321078c897a5de0b4b4304f234da0 and fixed in 6.8.10 with commit 1876881c9a49613b5249fb400cbf53412d90cb09
	Issue introduced in 2.6.26 with commit 5e5f3f0f801321078c897a5de0b4b4304f234da0 and fixed in 6.9 with commit d101291b2681e5ab938554e3e323f7a7ee33e3aa

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2024-36902
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/ipv6/fib6_rules.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/4a5a573387da6a6b23a4cc62147453ff1bc32afa
	https://git.kernel.org/stable/c/ddec23f206a944c73bcc2724358b85388837daff
	https://git.kernel.org/stable/c/674c951ab8a23f7aff9b4c3f2f865901bc76a290
	https://git.kernel.org/stable/c/35297fc68de36826087e976f86a5b1f94fd0bf95
	https://git.kernel.org/stable/c/7e3242c139c38e60844638e394c2877b16b396b0
	https://git.kernel.org/stable/c/8745a8d74ba17dafe72b6ab461fa6c007d879747
	https://git.kernel.org/stable/c/1876881c9a49613b5249fb400cbf53412d90cb09
	https://git.kernel.org/stable/c/d101291b2681e5ab938554e3e323f7a7ee33e3aa