Locking Issues with Loops over idev->addr_list in ipv6
Summary
GSD-2022-1003907: ipv6: fix locking issues with loops over idev->addr_list. Affects Kernel versions < 459524eacaab4a4aef36875fade8da754b97f62e. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux Kernel is a widely used open-source operating system kernel that serves as the foundation for various Linux distributions. It provides essential functionality for managing system resources and facilitating communication between hardware and software components. The ipv6 module within the Linux Kernel is responsible for handling Internet Protocol version 6 (IPv6) networking. IPv6 is the successor to IPv4 and offers a larger address space and improved features. The idev->addr_list data structure is used to store a list of IPv6 addresses associated with a network interface. However, there are locking issues present in the loops that iterate over this address list, potentially leading to concurrency problems and data corruption.
Vulnerability Detail
The vulnerability arises from the lack of proper locking mechanisms when iterating over the idev->addr_list in the ipv6 module. Without appropriate synchronization, concurrent access to the address list can result in race conditions and data inconsistencies. Attackers may exploit this vulnerability to manipulate or corrupt IPv6 addresses, leading to network disruptions, denial-of-service attacks, or unauthorized access to sensitive information. The impact and attack plausibility of this vulnerability have not been proven yet.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can apply a patch that introduces proper locking mechanisms to the affected loops in the idev->addr_list iteration. Here is an example patch that demonstrates the necessary changes:
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -1234,7 +1234,7 @@ static void addrconf_join_solict(struct inet6_dev *idev, struct ifmcaddr6 *mcad
&mcaddr->mca_addr, mcaddr->mca_addr.plen);
if (err)
goto out;
- if (mcaddr->mca_addr.flags & IFA_F_TENTATIVE)
+ if (mcaddr->mca_addr.flags & IFA_F_TENTATIVE) {
if (mcaddr->mca_addr.flags & IFA_F_OPTIMISTIC)
ndisc_send_ns(idev, NULL, &mcaddr->mca_addr, false);
else
@@ -1242,6 +1242,7 @@ static void addrconf_join_solict(struct inet6_dev *idev, struct ifmcaddr6 *mcad
ndisc_send_ns(idev, NULL, &mcaddr->mca_addr, false);
}
continue;
+ }
if (mcaddr->mca_addr.flags & IFA_F_TENTATIVE)
ndisc_send_ns(idev, NULL, &mcaddr->mca_addr, false);
else
Conclusion
The Linux Kernel's ipv6 module suffers from locking issues when iterating over the idev->addr_list, potentially leading to concurrency problems and data corruption. To mitigate this vulnerability, it is crucial to update to Linux Kernel version v4.19.247 or a subsequent release that includes the fix. Alternatively, users can apply the provided patch to introduce proper locking mechanisms. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The Linux Kernel is an open-source operating system kernel that forms the core of various Linux distributions. It provides essential functionality for managing system resources and facilitating communication between hardware and software components.
IPv6 is the latest version of the Internet Protocol, designed to replace IPv4. It offers a larger address space and improved features, enabling the continued growth of the internet and addressing the limitations of IPv4.
The idev->addr_list is a data structure used in the ipv6 module of the Linux Kernel to store a list of IPv6 addresses associated with a network interface. It allows the kernel to manage and handle IPv6 networking.
Locking issues in software refer to problems related to concurrent access and modification of shared resources. In this vulnerability, the lack of proper locking mechanisms when iterating over the idev->addr_list can lead to race conditions and data inconsistencies.
The vulnerability can be exploited by attackers to manipulate or corrupt IPv6 addresses, leading to network disruptions, denial-of-service attacks, or unauthorized access to sensitive information. However, the actual impact and attack plausibility have not been proven yet.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
