cve/published/2024/CVE-2024-40960.mbox

From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: <linux-cve-announce@vger.kernel.org>
Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org>
Subject: CVE-2024-40960: ipv6: prevent possible NULL dereference in rt6_probe()

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

ipv6: prevent possible NULL dereference in rt6_probe()

syzbot caught a NULL dereference in rt6_probe() [1]

Bail out if  __in6_dev_get() returns NULL.

[1]
Oops: general protection fault, probably for non-canonical address 0xdffffc00000000cb: 0000 [#1] PREEMPT SMP KASAN PTI
KASAN: null-ptr-deref in range [0x0000000000000658-0x000000000000065f]
CPU: 1 PID: 22444 Comm: syz-executor.0 Not tainted 6.10.0-rc2-syzkaller-00383-gb8481381d4e2 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024
 RIP: 0010:rt6_probe net/ipv6/route.c:656 [inline]
 RIP: 0010:find_match+0x8c4/0xf50 net/ipv6/route.c:758
Code: 14 fd f7 48 8b 85 38 ff ff ff 48 c7 45 b0 00 00 00 00 48 8d b8 5c 06 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f> b6 14 02 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 19
RSP: 0018:ffffc900034af070 EFLAGS: 00010203
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffc90004521000
RDX: 00000000000000cb RSI: ffffffff8990d0cd RDI: 000000000000065c
RBP: ffffc900034af150 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000002 R12: 000000000000000a
R13: 1ffff92000695e18 R14: ffff8880244a1d20 R15: 0000000000000000
FS:  00007f4844a5a6c0(0000) GS:ffff8880b9300000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b31b27000 CR3: 000000002d42c000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
  rt6_nh_find_match+0xfa/0x1a0 net/ipv6/route.c:784
  nexthop_for_each_fib6_nh+0x26d/0x4a0 net/ipv4/nexthop.c:1496
  __find_rr_leaf+0x6e7/0xe00 net/ipv6/route.c:825
  find_rr_leaf net/ipv6/route.c:853 [inline]
  rt6_select net/ipv6/route.c:897 [inline]
  fib6_table_lookup+0x57e/0xa30 net/ipv6/route.c:2195
  ip6_pol_route+0x1cd/0x1150 net/ipv6/route.c:2231
  pol_lookup_func include/net/ip6_fib.h:616 [inline]
  fib6_rule_lookup+0x386/0x720 net/ipv6/fib6_rules.c:121
  ip6_route_output_flags_noref net/ipv6/route.c:2639 [inline]
  ip6_route_output_flags+0x1d0/0x640 net/ipv6/route.c:2651
  ip6_dst_lookup_tail.constprop.0+0x961/0x1760 net/ipv6/ip6_output.c:1147
  ip6_dst_lookup_flow+0x99/0x1d0 net/ipv6/ip6_output.c:1250
  rawv6_sendmsg+0xdab/0x4340 net/ipv6/raw.c:898
  inet_sendmsg+0x119/0x140 net/ipv4/af_inet.c:853
  sock_sendmsg_nosec net/socket.c:730 [inline]
  __sock_sendmsg net/socket.c:745 [inline]
  sock_write_iter+0x4b8/0x5c0 net/socket.c:1160
  new_sync_write fs/read_write.c:497 [inline]
  vfs_write+0x6b6/0x1140 fs/read_write.c:590
  ksys_write+0x1f8/0x260 fs/read_write.c:643
  do_syscall_x64 arch/x86/entry/common.c:52 [inline]
  do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

The Linux kernel CVE team has assigned CVE-2024-40960 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 2.6.17 with commit 52e1635631b342803aecaf81a362c1464e3da2e5 and fixed in 4.19.317 with commit f0cda984e4e634b221dbf9642b8ecc5b4806b41e
	Issue introduced in 2.6.17 with commit 52e1635631b342803aecaf81a362c1464e3da2e5 and fixed in 5.4.279 with commit d66fc4826127c82f99c4033380f8e93833d331c7
	Issue introduced in 2.6.17 with commit 52e1635631b342803aecaf81a362c1464e3da2e5 and fixed in 5.10.221 with commit 1ed9849fdf9a1a617129346b11d2094ca26828dc
	Issue introduced in 2.6.17 with commit 52e1635631b342803aecaf81a362c1464e3da2e5 and fixed in 5.15.162 with commit 569c9d9ea6648d099187527b93982f406ddcebc0
	Issue introduced in 2.6.17 with commit 52e1635631b342803aecaf81a362c1464e3da2e5 and fixed in 6.1.96 with commit 51ee2f7c30790799d0ec30c0ce0c743e58f046f2
	Issue introduced in 2.6.17 with commit 52e1635631b342803aecaf81a362c1464e3da2e5 and fixed in 6.6.36 with commit 73e7c8ca6ad76f29b2c99c20845a6f3b203ff0c6
	Issue introduced in 2.6.17 with commit 52e1635631b342803aecaf81a362c1464e3da2e5 and fixed in 6.9.7 with commit 6eed6d3cd19ff3cfa83aeceed86da14abaf7417b
	Issue introduced in 2.6.17 with commit 52e1635631b342803aecaf81a362c1464e3da2e5 and fixed in 6.10 with commit b86762dbe19a62e785c189f313cda5b989931f37

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2024-40960
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/ipv6/route.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/f0cda984e4e634b221dbf9642b8ecc5b4806b41e
	https://git.kernel.org/stable/c/d66fc4826127c82f99c4033380f8e93833d331c7
	https://git.kernel.org/stable/c/1ed9849fdf9a1a617129346b11d2094ca26828dc
	https://git.kernel.org/stable/c/569c9d9ea6648d099187527b93982f406ddcebc0
	https://git.kernel.org/stable/c/51ee2f7c30790799d0ec30c0ce0c743e58f046f2
	https://git.kernel.org/stable/c/73e7c8ca6ad76f29b2c99c20845a6f3b203ff0c6
	https://git.kernel.org/stable/c/6eed6d3cd19ff3cfa83aeceed86da14abaf7417b
	https://git.kernel.org/stable/c/b86762dbe19a62e785c189f313cda5b989931f37