CVSS 5.5 · Medium EPSS 0,13%
Kerentanan NULL Pointer Dereference pada linux kernel. Skor CVSS 3.1 5.5 (Medium) menurut NVD.
In the Linux kernel, the following vulnerability has been resolved: ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu() l3mdev_master_dev_rcu() can return NULL when the slave device is being un-slaved from a VRF. All other callers deal with this, but we lost the fallback to loopback in ip6_rt_pcpu_alloc() -> ip6_rt_get_dev_rcu() with commit 4832c30d5458 ("net: ipv6: put host and anycast routes on device with address"). KASAN: null-ptr-deref in range [0x0000000000000108-0x000000000000010f] RIP: 0010:ip6_rt_pcpu_alloc (net/ipv6/route.c:1418) Call Trace: ip6_pol_route (net/ipv6/route.c:2318) fib6_rule_lookup (net/ipv6/fib6_rules.c:115) ip6_route_output_flags (net/ipv6/route.c:2607) vrf_process_v6_outbound (drivers/net/vrf.c:437) I was tempted to rework the un-slaving code to clear the flag first and insert synchronize_rcu() before we remove the upper. But looks like the explicit fallback to loopback_dev is an established pattern. And I guess avoiding the synchronize_rcu() is nice, too.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
· uraikan di kalkulator | Vendor | Produk | Versi terdampak |
|---|---|---|
| linux | linux kernel | Versi 4.14 hingga sebelum 5.10.253 |
| linux | linux kernel | Versi 5.11 hingga sebelum 5.15.203 |
| linux | linux kernel | Versi 5.16 hingga sebelum 6.1.167 |
| linux | linux kernel | Versi 6.2 hingga sebelum 6.6.130 |
| linux | linux kernel | Versi 6.7 hingga sebelum 6.12.77 |
| linux | linux kernel | Versi 6.13 hingga sebelum 6.18.17 |
| linux | linux kernel | Versi 6.19 hingga sebelum 6.19.7 |
| linux | linux kernel | Versi 7.0 rc1 |
| linux | linux kernel | Versi 7.0 rc2 |