UBUNTU-CVE-2024-40905
In the Linux kernel, the following vulnerability has been resolved: ipv6: fix possible race in __fib6_drop_pcpu_from() syzbot found a race in __fib6_drop_pcpu_from() [1] If compiler reads more than once (*ppcpu_rt), second read could read NULL, if another cpu clears the value in rt6_get_pcpu_route(). Add a READ_ONCE() to prevent this race. Also add rcu_read_lock()/rcu_read_unlock() because we rely on RCU protection while dereferencing pcpu_rt. [1] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000012: 0000 [#1] PREEMPT SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000090-0x0000000000000097] CPU: 0 PID: 7543 Comm: kworker/u8:17 Not tainted 6.10.0-rc1-syzkaller-00013-g2bfcfd584ff5 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024 Workqueue: netns cleanup_net RIP: 0010:__fib6_drop_pcpu_from.part.0+0x10a/0x370 net/ipv6/ip6_fib.c:984 Code: f8 48 c1 e8 03 80 3c 28 00 0f 85 16 02 00 00 4d 8b 3f 4d 85 ff 74 31 e8 74 a7 fa f7 49 8d bf 90 00 00 00 48 89 f8 48 c1 e8 03 <80> 3c 28 00 0f 85 1e 02 00 00 49 8b 87 90 00 00 00 48 8b 0c 24 48 RSP: 0018:ffffc900040df070 EFLAGS: 00010206 RAX: 0000000000000012 RBX: 0000000000000001 RCX: ffffffff89932e16 RDX: ffff888049dd1e00 RSI: ffffffff89932d7c RDI: 0000000000000091 RBP: dffffc0000000000 R08: 0000000000000005 R09: 0000000000000007 R10: 0000000000000001 R11: 0000000000000006 R12: ffff88807fa080b8 R13: fffffbfff1a9a07d R14: ffffed100ff41022 R15: 0000000000000001 FS: 0000000000000000(0000) GS:ffff8880b9200000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000001b32c26000 CR3: 000000005d56e000 CR4: 00000000003526f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> __fib6_drop_pcpu_from net/ipv6/ip6_fib.c:966 [inline] fib6_drop_pcpu_from net/ipv6/ip6_fib.c:1027 [inline] fib6_purge_rt+0x7f2/0x9f0 net/ipv6/ip6_fib.c:1038 fib6_del_route net/ipv6/ip6_fib.c:1998 [inline] fib6_del+0xa70/0x17b0 net/ipv6/ip6_fib.c:2043 fib6_clean_node+0x426/0x5b0 net/ipv6/ip6_fib.c:2205 fib6_walk_continue+0x44f/0x8d0 net/ipv6/ip6_fib.c:2127 fib6_walk+0x182/0x370 net/ipv6/ip6_fib.c:2175 fib6_clean_tree+0xd7/0x120 net/ipv6/ip6_fib.c:2255 __fib6_clean_all+0x100/0x2d0 net/ipv6/ip6_fib.c:2271 rt6_sync_down_dev net/ipv6/route.c:4906 [inline] rt6_disable_ip+0x7ed/0xa00 net/ipv6/route.c:4911 addrconf_ifdown.isra.0+0x117/0x1b40 net/ipv6/addrconf.c:3855 addrconf_notify+0x223/0x19e0 net/ipv6/addrconf.c:3778 notifier_call_chain+0xb9/0x410 kernel/notifier.c:93 call_netdevice_notifiers_info+0xbe/0x140 net/core/dev.c:1992 call_netdevice_notifiers_extack net/core/dev.c:2030 [inline] call_netdevice_notifiers net/core/dev.c:2044 [inline] dev_close_many+0x333/0x6a0 net/core/dev.c:1585 unregister_netdevice_many_notify+0x46d/0x19f0 net/core/dev.c:11193 unregister_netdevice_many net/core/dev.c:11276 [inline] default_device_exit_batch+0x85b/0xae0 net/core/dev.c:11759 ops_exit_list+0x128/0x180 net/core/net_namespace.c:178 cleanup_net+0x5b7/0xbf0 net/core/net_namespace.c:640 process_one_work+0x9fb/0x1b60 kernel/workqueue.c:3231 process_scheduled_works kernel/workqueue.c:3312 [inline] worker_thread+0x6c8/0xf70 kernel/workqueue.c:3393 kthread+0x2c1/0x3a0 kernel/kthread.c:389 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
02 / AFFECTED SOFTWARE
Affected packages
11 explicit affected versions
37 explicit affected versions
13 explicit affected versions
2 explicit affected versions
10 explicit affected versions
31 explicit affected versions
1 explicit affected versions
34 explicit affected versions
26 explicit affected versions
13 explicit affected versions
144 explicit affected versions
6 explicit affected versions
1 explicit affected versions
29 explicit affected versions
85 explicit affected versions
13 explicit affected versions
55 explicit affected versions
3 explicit affected versions
4 explicit affected versions
1 explicit affected versions
80 explicit affected versions
53 explicit affected versions
97 explicit affected versions
15 explicit affected versions
33 explicit affected versions
23 explicit affected versions
10 explicit affected versions
1 explicit affected versions
188 explicit affected versions
11 explicit affected versions
12 explicit affected versions
7 explicit affected versions
12 explicit affected versions
95 explicit affected versions
138 explicit affected versions
2 explicit affected versions
42 explicit affected versions
36 explicit affected versions
132 explicit affected versions
52 explicit affected versions
165 explicit affected versions
154 explicit affected versions
10 explicit affected versions
26 explicit affected versions
11 explicit affected versions
31 explicit affected versions
1 explicit affected versions
3 explicit affected versions
12 explicit affected versions
13 explicit affected versions
11 explicit affected versions
139 explicit affected versions
55 explicit affected versions
16 explicit affected versions
55 explicit affected versions
12 explicit affected versions
43 explicit affected versions
116 explicit affected versions
3 explicit affected versions
93 explicit affected versions
1 explicit affected versions
2 explicit affected versions
62 explicit affected versions
51 explicit affected versions
92 explicit affected versions
9 explicit affected versions
12 explicit affected versions
41 explicit affected versions
27 explicit affected versions
27 explicit affected versions
1 explicit affected versions
1 explicit affected versions
98 explicit affected versions
5 explicit affected versions
8 explicit affected versions
16 explicit affected versions
5 explicit affected versions
8 explicit affected versions
1 explicit affected versions
10 explicit affected versions
8 explicit affected versions
13 explicit affected versions
84 explicit affected versions
13 explicit affected versions
49 explicit affected versions
7 explicit affected versions
140 explicit affected versions
94 explicit affected versions
46 explicit affected versions
10 explicit affected versions
13 explicit affected versions
12 explicit affected versions
84 explicit affected versions
44 explicit affected versions
16 explicit affected versions
3 explicit affected versions
13 explicit affected versions
26 explicit affected versions
41 explicit affected versions
37 explicit affected versions
12 explicit affected versions
14 explicit affected versions
38 explicit affected versions
167 explicit affected versions
44 explicit affected versions
9 explicit affected versions
44 explicit affected versions
11 explicit affected versions
4 explicit affected versions
52 explicit affected versions
7 explicit affected versions
25 explicit affected versions
97 explicit affected versions
56 explicit affected versions
121 explicit affected versions
4 explicit affected versions
1 explicit affected versions
1 explicit affected versions
50 explicit affected versions
13 explicit affected versions
43 explicit affected versions
50 explicit affected versions
10 explicit affected versions
8 explicit affected versions
7 explicit affected versions
14 explicit affected versions
85 explicit affected versions
4 explicit affected versions
74 explicit affected versions
11 explicit affected versions
1 explicit affected versions
69 explicit affected versions
5 explicit affected versions
35 explicit affected versions
49 explicit affected versions
50 explicit affected versions
6 explicit affected versions
12 explicit affected versions
19 explicit affected versions
6 explicit affected versions
58 explicit affected versions
10 explicit affected versions
44 explicit affected versions
65 explicit affected versions
54 explicit affected versions
44 explicit affected versions
10 explicit affected versions
3 explicit affected versions
9 explicit affected versions
51 explicit affected versions
7 explicit affected versions
50 explicit affected versions
4 explicit affected versions
92 explicit affected versions
13 explicit affected versions
85 explicit affected versions
6 explicit affected versions
35 explicit affected versions
11 explicit affected versions
16 explicit affected versions
18 explicit affected versions
12 explicit affected versions
118 explicit affected versions
37 explicit affected versions
9 explicit affected versions
94 explicit affected versions
13 explicit affected versions
4 explicit affected versions
121 explicit affected versions
23 explicit affected versions
13 explicit affected versions
1 explicit affected versions
21 explicit affected versions
16 explicit affected versions
10 explicit affected versions
49 explicit affected versions
11 explicit affected versions
7 explicit affected versions
12 explicit affected versions
111 explicit affected versions
42 explicit affected versions
12 explicit affected versions
14 explicit affected versions
7 explicit affected versions
82 explicit affected versions
12 explicit affected versions
97 explicit affected versions
105 explicit affected versions
12 explicit affected versions
4 explicit affected versions
93 explicit affected versions
120 explicit affected versions
11 explicit affected versions
5 explicit affected versions
10 explicit affected versions
03 / CONNECTIONS
Connected vulnerabilities
04 / EVIDENCE
Source records
In the Linux kernel, the following vulnerability has been resolved: ipv6: fix possible race in __fib6_drop_pcpu_from() syzbot found a race in __fib6_drop_pcpu_from() [1] If compiler reads more than once (*ppcpu_rt), second read could read NULL, if another cpu clears the value in rt6_get_pcpu_route(). Add a READ_ONCE() to prevent this race. Also add rcu_read_lock()/rcu_read_unlock() because we rely on RCU protection while dereferencing pcpu_rt. [1] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000012: 0000 [#1] PREEMPT SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000090-0x0000000000000097] CPU: 0 PID: 7543 Comm: kworker/u8:17 Not tainted 6.10.0-rc1-syzkaller-00013-g2bfcfd584ff5 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024 Workqueue: netns cleanup_net RIP: 0010:__fib6_drop_pcpu_from.part.0+0x10a/0x370 net/ipv6/ip6_fib.c:984 Code: f8 48 c1 e8 03 80 3c 28 00 0f 85 16 02 00 00 4d 8b 3f 4d 85 ff 74 31 e8 74 a7 fa f7 49 8d bf 90 00 00 00 48 89 f8 48 c1 e8 03 <80> 3c 28 00 0f 85 1e 02 00 00 49 8b 87 90 00 00 00 48 8b 0c 24 48 RSP: 0018:ffffc900040df070 EFLAGS: 00010206 RAX: 0000000000000012 RBX: 0000000000000001 RCX: ffffffff89932e16 RDX: ffff888049dd1e00 RSI: ffffffff89932d7c RDI: 0000000000000091 RBP: dffffc0000000000 R08: 0000000000000005 R09: 0000000000000007 R10: 0000000000000001 R11: 0000000000000006 R12: ffff88807fa080b8 R13: fffffbfff1a9a07d R14: ffffed100ff41022 R15: 0000000000000001 FS: 0000000000000000(0000) GS:ffff8880b9200000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000001b32c26000 CR3: 000000005d56e000 CR4: 00000000003526f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> __fib6_drop_pcpu_from net/ipv6/ip6_fib.c:966 [inline] fib6_drop_pcpu_from net/ipv6/ip6_fib.c:1027 [inline] fib6_purge_rt+0x7f2/0x9f0 net/ipv6/ip6_fib.c:1038 fib6_del_route net/ipv6/ip6_fib.c:1998 [inline] fib6_del+0xa70/0x17b0 net/ipv6/ip6_fib.c:2043 fib6_clean_node+0x426/0x5b0 net/ipv6/ip6_fib.c:2205 fib6_walk_continue+0x44f/0x8d0 net/ipv6/ip6_fib.c:2127 fib6_walk+0x182/0x370 net/ipv6/ip6_fib.c:2175 fib6_clean_tree+0xd7/0x120 net/ipv6/ip6_fib.c:2255 __fib6_clean_all+0x100/0x2d0 net/ipv6/ip6_fib.c:2271 rt6_sync_down_dev net/ipv6/route.c:4906 [inline] rt6_disable_ip+0x7ed/0xa00 net/ipv6/route.c:4911 addrconf_ifdown.isra.0+0x117/0x1b40 net/ipv6/addrconf.c:3855 addrconf_notify+0x223/0x19e0 net/ipv6/addrconf.c:3778 notifier_call_chain+0xb9/0x410 kernel/notifier.c:93 call_netdevice_notifiers_info+0xbe/0x140 net/core/dev.c:1992 call_netdevice_notifiers_extack net/core/dev.c:2030 [inline] call_netdevice_notifiers net/core/dev.c:2044 [inline] dev_close_many+0x333/0x6a0 net/core/dev.c:1585 unregister_netdevice_many_notify+0x46d/0x19f0 net/core/dev.c:11193 unregister_netdevice_many net/core/dev.c:11276 [inline] default_device_exit_batch+0x85b/0xae0 net/core/dev.c:11759 ops_exit_list+0x128/0x180 net/core/net_namespace.c:178 cleanup_net+0x5b7/0xbf0 net/core/net_namespace.c:640 process_one_work+0x9fb/0x1b60 kernel/workqueue.c:3231 process_scheduled_works kernel/workqueue.c:3312 [inline] worker_thread+0x6c8/0xf70 kernel/workqueue.c:3393 kthread+0x2c1/0x3a0 kernel/kthread.c:389 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
05 / REFERENCES
Further evidence
- https://git.kernel.org/linus/b01e1c030770ff3b4fe37fc7cc6bca03f594133f
- https://git.kernel.org/stable/c/09e5a5a80e205922151136069e440477d6816914
- https://git.kernel.org/stable/c/2498960dac9b6fc49b6d1574f7cd1a4872744adf
- https://git.kernel.org/stable/c/7e796c3fefa8b17b30e7252886ae8cffacd2b9ef
- https://git.kernel.org/stable/c/a0bc020592b54a8f3fa2b7f244b6e39e526c2e12
- https://git.kernel.org/stable/c/b01e1c030770ff3b4fe37fc7cc6bca03f594133f
- https://git.kernel.org/stable/c/c693698787660c97950bc1f93a8dd19d8307153d
- https://git.kernel.org/stable/c/c90af1cced2f669a7b2304584be4ada495eaa0e5
- https://ubuntu.com/security/CVE-2024-40905
- https://ubuntu.com/security/notices/USN-6999-1
- https://ubuntu.com/security/notices/USN-6999-2
- https://ubuntu.com/security/notices/USN-7003-1
- https://ubuntu.com/security/notices/USN-7003-2
- https://ubuntu.com/security/notices/USN-7003-3
- https://ubuntu.com/security/notices/USN-7003-4
- https://ubuntu.com/security/notices/USN-7003-5
- https://ubuntu.com/security/notices/USN-7004-1
- https://ubuntu.com/security/notices/USN-7005-1
- https://ubuntu.com/security/notices/USN-7005-2
- https://ubuntu.com/security/notices/USN-7006-1
- https://ubuntu.com/security/notices/USN-7007-1
- https://ubuntu.com/security/notices/USN-7007-2
- https://ubuntu.com/security/notices/USN-7007-3
- https://ubuntu.com/security/notices/USN-7008-1
- https://ubuntu.com/security/notices/USN-7009-1
- https://ubuntu.com/security/notices/USN-7009-2
- https://ubuntu.com/security/notices/USN-7019-1
- https://ubuntu.com/security/notices/USN-7029-1
- https://www.cve.org/CVERecord?id=CVE-2024-40905