net/ipv6: avoid possible UAF in ip6_route_mpath_notify()
In the Linux kernel, the following vulnerability has been resolved: net/ipv6: avoid possible UAF in ip6_route_mpath_notify() syzbot found another use-after-free in ip6_route_mpath_notify() [1] Commit f7225172f25a ("net/ipv6: prevent use after free in ip6_route_mpath_notify") was not able to fix the root cause. We need to defer the fib6_info_release() calls after ip6_route_mpath_notify(), in the cleanup phase. [1] BUG: KASAN: slab-use-after-free in rt6_fill_node+0x1460/0x1ac0 Read of size 4 at addr ffff88809a07fc64 by task syz-executor.2/23037 CPU: 0 PID: 23037 Comm: syz-executor.2 Not tainted 6.8.0-rc4-syzkaller-01035-gea7f3cfaa588 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1e7/0x2e0 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:377 [inline] print_report+0x167/0x540 mm/kasan/report.c:488 kasan_report+0x142/0x180 mm/kasan/report.c:601 rt6_fill_node+0x1460/0x1ac0 inet6_rt_notify+0x13b/0x290 net/ipv6/route.c:6184 ip6_route_mpath_notify net/ipv6/route.c:5198 [inline] ip6_route_multipath_add net/ipv6/route.c:5404 [inline] inet6_rtm_newroute+0x1d0f/0x2300 net/ipv6/route.c:5517 rtnetlink_rcv_msg+0x885/0x1040 net/core/rtnetlink.c:6597 netlink_rcv_skb+0x1e3/0x430 net/netlink/af_netlink.c:2543 netlink_unicast_kernel net/netlink/af_netlink.c:1341 [inline] netlink_unicast+0x7ea/0x980 net/netlink/af_netlink.c:1367 netlink_sendmsg+0xa3b/0xd70 net/netli
CVE-2024-26852
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2024-26852
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "3b1137fe74829e021f483756a648cbb87c8a1b4a",
"lessThan": "31ea5bcc7d4cd1423de6be327a2c034725704136",
"versionType": "git"
},
{
"status": "affected",
"version": "3b1137fe74829e021f483756a648cbb87c8a1b4a",
"lessThan": "664f9c647260cc9d68b4e31d9899530d89dd045e",
"versionType": "git"
},
{
"status": "affected",
"version": "3b1137fe74829e021f483756a648cbb87c8a1b4a",
"lessThan": "79ce2e54cc0ae366f45516c00bf1b19aa43e9abe",
"versionType": "git"
},
{
"status": "affected",
"version": "3b1137fe74829e021f483756a648cbb87c8a1b4a",
"lessThan": "cae3303257950d03ffec2df4a45e836f10d26c24",
"versionType": "git"
},
{
"status": "affected",
"version": "3b1137fe74829e021f483756a648cbb87c8a1b4a",
"lessThan": "394334fe2ae3b9f1e2332b873857e84cb28aac18",
"versionType": "git"
},
{
"status": "affected",
"version": "3b1137fe74829e021f483756a648cbb87c8a1b4a",
"lessThan": "ed883060c38721ed828061f6c0c30e5147326c9a",
"versionType": "git"
},
{
"status": "affected",
"version": "3b1137fe74829e021f483756a648cbb87c8a1b4a",
"lessThan": "61b34f73cdbdb8eaf9ea12e9e2eb3b29716c4dda",
"versionType": "git"
},
{
"status": "affected",
"version": "3b1137fe74829e021f483756a648cbb87c8a1b4a",
"lessThan": "685f7d531264599b3f167f1e94bbd22f120e5fab",
"versionType": "git"
}
],
"programFiles": [
"net/ipv6/route.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "4.11"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "4.11",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "4.19.310",
"versionType": "semver",
"lessThanOrEqual": "4.19.*"
},
{
"status": "unaffected",
"version": "5.4.272",
"versionType": "semver",
"lessThanOrEqual": "5.4.*"
},
{
"status": "unaffected",
"version": "5.10.213",
"versionType": "semver",
"lessThanOrEqual": "5.10.*"
},
{
"status": "unaffected",
"version": "5.15.152",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.82",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.22",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.7.10",
"versionType": "semver",
"lessThanOrEqual": "6.7.*"
},
{
"status": "unaffected",
"version": "6.8",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"net/ipv6/route.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2024-26852
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #26433 · Revision 1
- Added to Heist Feed
- Publisher date