In the Linux kernel, the following vulnerability has been resolved:
ipv6: fix race condition between ipv6getifaddr and ipv6deladdr
Although ipv6getifaddr walks inet6addrlst under the RCU lock, it still means hlistforeachentryrcu can return an item that got removed from the list. The memory itself of such item is not freed thanks to RCU but nothing guarantees the actual content of the memory is sane.
In particular, the reference count can be zero. This can happen if ipv6deladdr is called in parallel. ipv6deladdr removes the entry from inet6addrlst (hlistdelinitrcu(&ifp->addrlst)) and drops all references (_in6ifaput(ifp) + in6ifa_put(ifp)). With bad enough timing, this can happen:
In ipv6getifaddr, hlistforeachentryrcu returns an entry.
Then, the whole ipv6deladdr is executed for the given entry. The reference count drops to zero and kfree_rcu is scheduled.
ipv6getifaddr continues and tries to increments the reference count (in6ifahold).
The rcu is unlocked and the entry is freed.
The freed entry is returned.
Prevent increasing of the reference count in such case. The name in6ifaholdsafe is chosen to mimic the existing fib6infoholdsafe.
[ 41.506330] refcountt: addition on 0; use-after-free. [ 41.506760] WARNING: CPU: 0 PID: 595 at lib/refcount.c:25 refcountwarnsaturate+0xa5/0x130 [ 41.507413] Modules linked in: veth bridge stp llc [ 41.507821] CPU: 0 PID: 595 Comm: python3 Not tainted 6.9.0-rc2.main-00208-g49563be82afa #14 [ 41.508479] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) [ 41.509163] RIP: 0010:refcountwarnsaturate+0xa5/0x130 [ 41.509586] Code: ad ff 90 0f 0b 90 90 c3 cc cc cc cc 80 3d c0 30 ad 01 00 75 a0 c6 05 b7 30 ad 01 01 90 48 c7 c7 38 cc 7a 8c e8 cc 18 ad ff 90 <0f> 0b 90 90 c3 cc cc cc cc 80 3d 98 30 ad 01 00 0f 85 75 ff ff ff [ 41.510956] RSP: 0018:ffffbda3c026baf0 EFLAGS: 00010282 [ 41.511368] RAX: 0000000000000000 RBX: ffff9e9c46914800 RCX: 0000000000000000 [ 41.511910] RDX: ffff9e9c7ec29c00 RSI: ffff9e9c7ec1c900 RDI: ffff9e9c7ec1c900 [ 41.512445] RBP: ffff9e9c43660c9c R08: 0000000000009ffb R09: 00000000ffffdfff [ 41.512998] R10: 00000000ffffdfff R11: ffffffff8ca58a40 R12: ffff9e9c4339a000 [ 41.513534] R13: 0000000000000001 R14: ffff9e9c438a0000 R15: ffffbda3c026bb48 [ 41.514086] FS: 00007fbc4cda1740(0000) GS:ffff9e9c7ec00000(0000) knlGS:0000000000000000 [ 41.514726] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 41.515176] CR2: 000056233b337d88 CR3: 000000000376e006 CR4: 0000000000370ef0 [ 41.515713] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 41.516252] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 41.516799] Call Trace: [ 41.517037] <TASK> [ 41.517249] ? _warn+0x7b/0x120 [ 41.517535] ? refcountwarnsaturate+0xa5/0x130 [ 41.517923] ? reportbug+0x164/0x190 [ 41.518240] ? handlebug+0x3d/0x70 [ 41.518541] ? excinvalidop+0x17/0x70 [ 41.520972] ? asmexcinvalidop+0x1a/0x20 [ 41.521325] ? refcountwarnsaturate+0xa5/0x130 [ 41.521708] ipv6getifaddr+0xda/0xe0 [ 41.522035] inet6rtmgetaddr+0x342/0x3f0 [ 41.522376] ? _pfxinet6rtmgetaddr+0x10/0x10 [ 41.522758] rtnetlinkrcvmsg+0x334/0x3d0 [ 41.523102] ? netlinkunicast+0x30f/0x390 [ 41.523445] ? _pfxrtnetlinkrcvmsg+0x10/0x10 [ 41.523832] netlinkrcvskb+0x53/0x100 [ 41.524157] netlinkunicast+0x23b/0x390 [ 41.524484] netlinksendmsg+0x1f2/0x440 [ 41.524826] _syssendto+0x1d8/0x1f0 [ 41.525145] _x64syssendto+0x1f/0x30 [ 41.525467] dosyscall64+0xa5/0x1b0 [ 41.525794] entrySYSCALL64after_hwframe+0x72/0x7a [ 41.526213] RIP: 0033:0x7fbc4cfcea9a [ 41.526528] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb b8 0f 1f 00 f3 0f 1e fa 41 89 ca 64 8b 04 25 18 00 00 00 85 c0 75 15 b8 2c 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 7e c3 0f 1f 44 00 00 41 54 48 83 ec 30 44 89 [ 41.527942] RSP: 002b:00007f ---truncated---
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b4b3b69a19016d4e7fbdbd1dbcc184915eb862e1",
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "ipv6_get_ifaddr",
"file": "net/ipv6/addrconf.c"
},
"id": "CVE-2024-35969-05a23e5c",
"signature_type": "Function",
"digest": {
"length": 557.0,
"function_hash": "54325718739051407145147454426334783087"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6cdb20c342cd0193d3e956e3d83981d0f438bb83",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "include/net/addrconf.h"
},
"id": "CVE-2024-35969-14589d61",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"70603101636176751314013868143947287637",
"68790112011848113607113920798056479624",
"149576825381154859020002597002965036587"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7633c4da919ad51164acbf1aa322cc1a3ead6129",
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "ipv6_get_ifaddr",
"file": "net/ipv6/addrconf.c"
},
"id": "CVE-2024-35969-1c5d61e4",
"signature_type": "Function",
"digest": {
"length": 498.0,
"function_hash": "41032382694228860120488176644512415808"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3fb02ec57ead2891a2306af8c51a306bc5945e70",
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "ipv6_get_ifaddr",
"file": "net/ipv6/addrconf.c"
},
"id": "CVE-2024-35969-3bbf1d56",
"signature_type": "Function",
"digest": {
"length": 557.0,
"function_hash": "54325718739051407145147454426334783087"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@01b11a0566670612bd464a932e5ac2eae53d8652",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "net/ipv6/addrconf.c"
},
"id": "CVE-2024-35969-3d4fe40e",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"338379807444266622356915944593579159821",
"88435110180031087509360700786032340265",
"333350048327936214299382241760351230581",
"97072950942069934852127389093423812368",
"111051890471617550673984411021793217176",
"75407180318704451699303769443305508093"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4b19e9507c275de0cfe61c24db69179dc52cf9fb",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "include/net/addrconf.h"
},
"id": "CVE-2024-35969-457d9a02",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"70603101636176751314013868143947287637",
"68790112011848113607113920798056479624",
"149576825381154859020002597002965036587"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cca606e14264098cba65efa82790825dbf69e903",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "include/net/addrconf.h"
},
"id": "CVE-2024-35969-4b46e7bb",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"70603101636176751314013868143947287637",
"68790112011848113607113920798056479624",
"149576825381154859020002597002965036587"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@01b11a0566670612bd464a932e5ac2eae53d8652",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "include/net/addrconf.h"
},
"id": "CVE-2024-35969-572faaa4",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"70603101636176751314013868143947287637",
"68790112011848113607113920798056479624",
"149576825381154859020002597002965036587"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6cdb20c342cd0193d3e956e3d83981d0f438bb83",
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "ipv6_get_ifaddr",
"file": "net/ipv6/addrconf.c"
},
"id": "CVE-2024-35969-7006f827",
"signature_type": "Function",
"digest": {
"length": 498.0,
"function_hash": "41032382694228860120488176644512415808"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b4b3b69a19016d4e7fbdbd1dbcc184915eb862e1",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "net/ipv6/addrconf.c"
},
"id": "CVE-2024-35969-70b3eba1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"338379807444266622356915944593579159821",
"88435110180031087509360700786032340265",
"333350048327936214299382241760351230581",
"97072950942069934852127389093423812368",
"111051890471617550673984411021793217176",
"75407180318704451699303769443305508093"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@de76ae9ea1a6cf9e77fcec4f2df2904e26c23ceb",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "net/ipv6/addrconf.c"
},
"id": "CVE-2024-35969-72e3c8f6",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"338379807444266622356915944593579159821",
"88435110180031087509360700786032340265",
"333350048327936214299382241760351230581",
"97072950942069934852127389093423812368",
"111051890471617550673984411021793217176",
"75407180318704451699303769443305508093"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4b19e9507c275de0cfe61c24db69179dc52cf9fb",
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "ipv6_get_ifaddr",
"file": "net/ipv6/addrconf.c"
},
"id": "CVE-2024-35969-78a0cfe0",
"signature_type": "Function",
"digest": {
"length": 557.0,
"function_hash": "54325718739051407145147454426334783087"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6cdb20c342cd0193d3e956e3d83981d0f438bb83",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "net/ipv6/addrconf.c"
},
"id": "CVE-2024-35969-906b917d",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"338379807444266622356915944593579159821",
"88435110180031087509360700786032340265",
"333350048327936214299382241760351230581",
"97072950942069934852127389093423812368",
"111051890471617550673984411021793217176",
"75407180318704451699303769443305508093"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@de76ae9ea1a6cf9e77fcec4f2df2904e26c23ceb",
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "ipv6_get_ifaddr",
"file": "net/ipv6/addrconf.c"
},
"id": "CVE-2024-35969-93a0c7d6",
"signature_type": "Function",
"digest": {
"length": 498.0,
"function_hash": "41032382694228860120488176644512415808"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7633c4da919ad51164acbf1aa322cc1a3ead6129",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "net/ipv6/addrconf.c"
},
"id": "CVE-2024-35969-97597ebf",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"338379807444266622356915944593579159821",
"88435110180031087509360700786032340265",
"333350048327936214299382241760351230581",
"97072950942069934852127389093423812368",
"111051890471617550673984411021793217176",
"75407180318704451699303769443305508093"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@de76ae9ea1a6cf9e77fcec4f2df2904e26c23ceb",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "include/net/addrconf.h"
},
"id": "CVE-2024-35969-aae73f4d",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"70603101636176751314013868143947287637",
"68790112011848113607113920798056479624",
"149576825381154859020002597002965036587"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4b19e9507c275de0cfe61c24db69179dc52cf9fb",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "net/ipv6/addrconf.c"
},
"id": "CVE-2024-35969-adb8a737",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"338379807444266622356915944593579159821",
"88435110180031087509360700786032340265",
"333350048327936214299382241760351230581",
"97072950942069934852127389093423812368",
"111051890471617550673984411021793217176",
"75407180318704451699303769443305508093"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b4b3b69a19016d4e7fbdbd1dbcc184915eb862e1",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "include/net/addrconf.h"
},
"id": "CVE-2024-35969-b4acdae8",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"70603101636176751314013868143947287637",
"68790112011848113607113920798056479624",
"149576825381154859020002597002965036587"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cca606e14264098cba65efa82790825dbf69e903",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "net/ipv6/addrconf.c"
},
"id": "CVE-2024-35969-bef75ef5",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"338379807444266622356915944593579159821",
"88435110180031087509360700786032340265",
"333350048327936214299382241760351230581",
"97072950942069934852127389093423812368",
"111051890471617550673984411021793217176",
"75407180318704451699303769443305508093"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cca606e14264098cba65efa82790825dbf69e903",
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "ipv6_get_ifaddr",
"file": "net/ipv6/addrconf.c"
},
"id": "CVE-2024-35969-c2966f7c",
"signature_type": "Function",
"digest": {
"length": 557.0,
"function_hash": "54325718739051407145147454426334783087"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3fb02ec57ead2891a2306af8c51a306bc5945e70",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "net/ipv6/addrconf.c"
},
"id": "CVE-2024-35969-c49cf473",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"338379807444266622356915944593579159821",
"88435110180031087509360700786032340265",
"333350048327936214299382241760351230581",
"97072950942069934852127389093423812368",
"111051890471617550673984411021793217176",
"75407180318704451699303769443305508093"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3fb02ec57ead2891a2306af8c51a306bc5945e70",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "include/net/addrconf.h"
},
"id": "CVE-2024-35969-d7b6a493",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"70603101636176751314013868143947287637",
"68790112011848113607113920798056479624",
"149576825381154859020002597002965036587"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@01b11a0566670612bd464a932e5ac2eae53d8652",
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "ipv6_get_ifaddr",
"file": "net/ipv6/addrconf.c"
},
"id": "CVE-2024-35969-eba13845",
"signature_type": "Function",
"digest": {
"length": 498.0,
"function_hash": "41032382694228860120488176644512415808"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7633c4da919ad51164acbf1aa322cc1a3ead6129",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "include/net/addrconf.h"
},
"id": "CVE-2024-35969-f0b12374",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"70603101636176751314013868143947287637",
"68790112011848113607113920798056479624",
"149576825381154859020002597002965036587"
]
}
}
]