CVE-2024-40961

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

ipv6: prevent possible NULL deref in fib6_nh_init()

syzbot reminds us that in6_dev_get() can return NULL.

fib6_nh_init()

ip6_validate_gw( &idev )

ip6_route_check_nh( idev )

*idev = in6_dev_get(dev); // can be NULL

Oops: general protection fault, probably for non-canonical address 0xdffffc00000000bc: 0000 [#1] PREEMPT SMP KASAN PTI

KASAN: null-ptr-deref in range [0x00000000000005e0-0x00000000000005e7]

CPU: 0 PID: 11237 Comm: syz-executor.3 Not tainted 6.10.0-rc2-syzkaller-00249-gbe27b8965297 #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024

RIP: 0010:fib6_nh_init+0x640/0x2160 net/ipv6/route.c:3606

Code: 00 00 fc ff df 4c 8b 64 24 58 48 8b 44 24 28 4c 8b 74 24 30 48 89 c1 48 89 44 24 28 48 8d 98 e0 05 00 00 48 89 d8 48 c1 e8 03 <42> 0f b6 04 38 84 c0 0f 85 b3 17 00 00 8b 1b 31 ff 89 de e8 b8 8b

RSP: 0018:ffffc900032775a0 EFLAGS: 00010202

RAX: 000

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References