ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr
In the Linux kernel, the following vulnerability has been resolved: ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr Although ipv6_get_ifaddr walks inet6_addr_lst under the RCU lock, it still means hlist_for_each_entry_rcu can return an item that got removed from the list. The memory itself of such item is not freed thanks to RCU but nothing guarantees the actual content of the memory is sane. In particular, the reference count can be zero. This can happen if ipv6_del_addr is called in parallel. ipv6_del_addr removes the entry from inet6_addr_lst (hlist_del_init_rcu(&ifp->addr_lst)) and drops all references (__in6_ifa_put(ifp) + in6_ifa_put(ifp)). With bad enough timing, this can happen: 1. In ipv6_get_ifaddr, hlist_for_each_entry_rcu returns an entry. 2. Then, the whole ipv6_del_addr is executed for the given entry. The reference count drops to zero and kfree_rcu is scheduled. 3. ipv6_get_ifaddr continues and tries to increments the reference count (in6_ifa_hold). 4. The rcu is unlocked and the entry is freed. 5. The freed entry is returned. Prevent increasing of the reference count in such case. The name in6_ifa_hold_safe is chosen to mimic the existing fib6_info_hold_safe. [ 41.506330] refcount_t: addition on 0; use-after-free. [ 41.506760] WARNING: CPU: 0 PID: 595 at lib/refcount.c:25 refcount_warn_saturate+0xa5/0x130 [ 41.507413] Modules linked in: veth bridge stp llc [ 41.507821] CPU: 0 PID: 595 Comm: python3 Not tainted 6.9.0-rc2.main-00208-g49563be82
CVE-2024-35969
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2024-35969
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "5c578aedcb21d79eeb4e9cf04ca5b276ac82614c",
"lessThan": "b4b3b69a19016d4e7fbdbd1dbcc184915eb862e1",
"versionType": "git"
},
{
"status": "affected",
"version": "5c578aedcb21d79eeb4e9cf04ca5b276ac82614c",
"lessThan": "cca606e14264098cba65efa82790825dbf69e903",
"versionType": "git"
},
{
"status": "affected",
"version": "5c578aedcb21d79eeb4e9cf04ca5b276ac82614c",
"lessThan": "3fb02ec57ead2891a2306af8c51a306bc5945e70",
"versionType": "git"
},
{
"status": "affected",
"version": "5c578aedcb21d79eeb4e9cf04ca5b276ac82614c",
"lessThan": "4b19e9507c275de0cfe61c24db69179dc52cf9fb",
"versionType": "git"
},
{
"status": "affected",
"version": "5c578aedcb21d79eeb4e9cf04ca5b276ac82614c",
"lessThan": "de76ae9ea1a6cf9e77fcec4f2df2904e26c23ceb",
"versionType": "git"
},
{
"status": "affected",
"version": "5c578aedcb21d79eeb4e9cf04ca5b276ac82614c",
"lessThan": "01b11a0566670612bd464a932e5ac2eae53d8652",
"versionType": "git"
},
{
"status": "affected",
"version": "5c578aedcb21d79eeb4e9cf04ca5b276ac82614c",
"lessThan": "6cdb20c342cd0193d3e956e3d83981d0f438bb83",
"versionType": "git"
},
{
"status": "affected",
"version": "5c578aedcb21d79eeb4e9cf04ca5b276ac82614c",
"lessThan": "7633c4da919ad51164acbf1aa322cc1a3ead6129",
"versionType": "git"
}
],
"programFiles": [
"include/net/addrconf.h",
"net/ipv6/addrconf.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.35"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "2.6.35",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "4.19.313",
"versionType": "semver",
"lessThanOrEqual": "4.19.*"
},
{
"status": "unaffected",
"version": "5.4.275",
"versionType": "semver",
"lessThanOrEqual": "5.4.*"
},
{
"status": "unaffected",
"version": "5.10.216",
"versionType": "semver",
"lessThanOrEqual": "5.10.*"
},
{
"status": "unaffected",
"version": "5.15.156",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.87",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.28",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.8.7",
"versionType": "semver",
"lessThanOrEqual": "6.8.*"
},
{
"status": "unaffected",
"version": "6.9",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"include/net/addrconf.h",
"net/ipv6/addrconf.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2024-35969
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #26561 · Revision 1
- Added to Heist Feed
- Publisher date