Description
In the Linux kernel, the following vulnerability has been resolved: ipv6: fix fib6 walker UAF on seq stop ipv6_route_iter_active() treats a walker in FWS_U at the table root as already unlinked. fib6_del_route() can move a still-linked walker into that same state when the current leaf is the last route at the root, so ipv6_route_native_seq_stop() skips fib6_walker_unlink(). The seq private object can then be freed while it remains on net->ipv6.fib6_walkers. A later route deletion walks the dangling list and uses the freed walker. Use the list head as membership state and reinitialize it when unlinking. Keep the existing w->node check so a never-started iterator with a zeroed private object is not treated as linked. The same stop helper is used by /proc/net/ipv6_route and by the BPF ipv6_route iterator. The BPF show path only widens the race.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
8d2ca1d7b5c3e63b3a8a81ae99015b615c5f2bf7 to < 9a3f73d62c86271614eda4c43315230896a37018affected8d2ca1d7b5c3e63b3a8a81ae99015b615c5f2bf7 to < 63407cddabc5992b5ac03af165559f4a1968a032affected8d2ca1d7b5c3e63b3a8a81ae99015b615c5f2bf7 to < 05b687ee04f816658f4a9cf586f4d2f129157943affected8d2ca1d7b5c3e63b3a8a81ae99015b615c5f2bf7 to < 14fdaba201fdff92a3e45994e02bccda409cb19daffected8d2ca1d7b5c3e63b3a8a81ae99015b615c5f2bf7 to < 0eede1689610e9eeaf729ba86fd1321799eb91a0affected8d2ca1d7b5c3e63b3a8a81ae99015b615c5f2bf7 to < b89b691dd00bf39b9ba39ab9446f8c62f419fa7baffected8d2ca1d7b5c3e63b3a8a81ae99015b615c5f2bf7 to < 4553cfafa8d05c4ce20b1d18f79d9bb3b303fc02affected8d2ca1d7b5c3e63b3a8a81ae99015b615c5f2bf7 to < 19b4ed644d68098cc62ab612727f40d30f43476caffected
Linux Linux
Default version status: affected
3.13affected0 to < 3.13unaffected5.10.271 to ≤ 5.10.*unaffected5.15.222 to ≤ 5.15.*unaffected6.1.189 to ≤ 6.1.*unaffected6.6.158 to ≤ 6.6.*unaffected6.12.111 to ≤ 6.12.*unaffected6.18.53 to ≤ 6.18.*unaffected7.2.7 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/9a3f73d62c86271614eda4c43315230896a37018 ↗
- https://git.kernel.org/stable/c/63407cddabc5992b5ac03af165559f4a1968a032 ↗
- https://git.kernel.org/stable/c/05b687ee04f816658f4a9cf586f4d2f129157943 ↗
- https://git.kernel.org/stable/c/14fdaba201fdff92a3e45994e02bccda409cb19d ↗
- https://git.kernel.org/stable/c/0eede1689610e9eeaf729ba86fd1321799eb91a0 ↗
- https://git.kernel.org/stable/c/b89b691dd00bf39b9ba39ab9446f8c62f419fa7b ↗
- https://git.kernel.org/stable/c/4553cfafa8d05c4ce20b1d18f79d9bb3b303fc02 ↗
- https://git.kernel.org/stable/c/19b4ed644d68098cc62ab612727f40d30f43476c ↗