cve/published/2024/CVE-2024-40961.mbox

From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: <linux-cve-announce@vger.kernel.org>
Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org>
Subject: CVE-2024-40961: ipv6: prevent possible NULL deref in fib6_nh_init()

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

ipv6: prevent possible NULL deref in fib6_nh_init()

syzbot reminds us that in6_dev_get() can return NULL.

fib6_nh_init()
    ip6_validate_gw(  &idev  )
        ip6_route_check_nh(  idev  )
            *idev = in6_dev_get(dev); // can be NULL

Oops: general protection fault, probably for non-canonical address 0xdffffc00000000bc: 0000 [#1] PREEMPT SMP KASAN PTI
KASAN: null-ptr-deref in range [0x00000000000005e0-0x00000000000005e7]
CPU: 0 PID: 11237 Comm: syz-executor.3 Not tainted 6.10.0-rc2-syzkaller-00249-gbe27b8965297 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024
 RIP: 0010:fib6_nh_init+0x640/0x2160 net/ipv6/route.c:3606
Code: 00 00 fc ff df 4c 8b 64 24 58 48 8b 44 24 28 4c 8b 74 24 30 48 89 c1 48 89 44 24 28 48 8d 98 e0 05 00 00 48 89 d8 48 c1 e8 03 <42> 0f b6 04 38 84 c0 0f 85 b3 17 00 00 8b 1b 31 ff 89 de e8 b8 8b
RSP: 0018:ffffc900032775a0 EFLAGS: 00010202
RAX: 00000000000000bc RBX: 00000000000005e0 RCX: 0000000000000000
RDX: 0000000000000010 RSI: ffffc90003277a54 RDI: ffff88802b3a08d8
RBP: ffffc900032778b0 R08: 00000000000002fc R09: 0000000000000000
R10: 00000000000002fc R11: 0000000000000000 R12: ffff88802b3a08b8
R13: 1ffff9200064eec8 R14: ffffc90003277a00 R15: dffffc0000000000
FS:  00007f940feb06c0(0000) GS:ffff8880b9400000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 00000000245e8000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
  ip6_route_info_create+0x99e/0x12b0 net/ipv6/route.c:3809
  ip6_route_add+0x28/0x160 net/ipv6/route.c:3853
  ipv6_route_ioctl+0x588/0x870 net/ipv6/route.c:4483
  inet6_ioctl+0x21a/0x280 net/ipv6/af_inet6.c:579
  sock_do_ioctl+0x158/0x460 net/socket.c:1222
  sock_ioctl+0x629/0x8e0 net/socket.c:1341
  vfs_ioctl fs/ioctl.c:51 [inline]
  __do_sys_ioctl fs/ioctl.c:907 [inline]
  __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:893
  do_syscall_x64 arch/x86/entry/common.c:52 [inline]
  do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f940f07cea9

The Linux kernel CVE team has assigned CVE-2024-40961 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 4.17 with commit 428604fb118facce1309670779a35baf27ad044c and fixed in 5.4.279 with commit 3200ffeec4d59aad5bc9ca75d2c1fae47c0aeade
	Issue introduced in 4.17 with commit 428604fb118facce1309670779a35baf27ad044c and fixed in 5.10.221 with commit de5ad4d45cd0128a2a37555f48ab69aa19d78adc
	Issue introduced in 4.17 with commit 428604fb118facce1309670779a35baf27ad044c and fixed in 5.15.162 with commit 4cdfe813015d5a24586bd0a84fa0fa6eb0a1f668
	Issue introduced in 4.17 with commit 428604fb118facce1309670779a35baf27ad044c and fixed in 6.1.96 with commit 88b9a55e2e35ea846d41f4efdc29d23345bd1aa4
	Issue introduced in 4.17 with commit 428604fb118facce1309670779a35baf27ad044c and fixed in 6.6.36 with commit b6947723c9eabcab58cfb33cdb0a565a6aee6727
	Issue introduced in 4.17 with commit 428604fb118facce1309670779a35baf27ad044c and fixed in 6.9.7 with commit ae8d3d39efe366c2198f530e01e4bf07830bf403
	Issue introduced in 4.17 with commit 428604fb118facce1309670779a35baf27ad044c and fixed in 6.10 with commit 2eab4543a2204092c3a7af81d7d6c506e59a03a6

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2024-40961
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/ipv6/route.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/3200ffeec4d59aad5bc9ca75d2c1fae47c0aeade
	https://git.kernel.org/stable/c/de5ad4d45cd0128a2a37555f48ab69aa19d78adc
	https://git.kernel.org/stable/c/4cdfe813015d5a24586bd0a84fa0fa6eb0a1f668
	https://git.kernel.org/stable/c/88b9a55e2e35ea846d41f4efdc29d23345bd1aa4
	https://git.kernel.org/stable/c/b6947723c9eabcab58cfb33cdb0a565a6aee6727
	https://git.kernel.org/stable/c/ae8d3d39efe366c2198f530e01e4bf07830bf403
	https://git.kernel.org/stable/c/2eab4543a2204092c3a7af81d7d6c506e59a03a6