Vulnerability in Linux Kernel: net: ipv6: unexport __init-annotated seg6_hmac_net_init()
Summary
GSD-2022-1004442: net: ipv6: unexport __init-annotated seg6_hmac_net_init(). Affects Kernel versions >= bf355b8d2c30a289232042cacc1cfaea4923936c, < c9f8f94d3ca916e2eecc0ba8227466a871432628. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux Kernel is the core component of the Linux operating system, responsible for managing system resources and providing an interface for applications to interact with the hardware. It is a critical piece of software that enables the functioning of various devices and services. The vulnerability in question affects the IPv6 networking subsystem of the Linux Kernel. IPv6 is the latest version of the Internet Protocol, designed to replace IPv4 and provide a larger address space. The specific vulnerability, __init-annotated seg6_hmac_net_init(), is related to the initialization of the Segment Routing IPv6 (SRv6) HMAC networking feature. SRv6 is a mechanism that allows packets to be routed through a specific path in a network by encoding instructions in the IPv6 header. The vulnerability could potentially be exploited to execute arbitrary code or cause a denial-of-service (DoS) attack.
Vulnerability Detail
The vulnerability arises from the improper exporting of the __init-annotated seg6_hmac_net_init() function in the IPv6 networking subsystem of the Linux Kernel. This function is responsible for initializing the SRv6 HMAC networking feature. By not properly exporting this function, it may be possible for an attacker to bypass intended access restrictions and gain unauthorized control over the SRv6 HMAC functionality. This could lead to various security risks, including the execution of arbitrary code or the disruption of network services. The vulnerability was introduced in Linux Kernel version 4.10 and has been fixed in version 5.15.53.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can disable the SRv6 HMAC networking feature if it is not required for their specific use case. This can be done by modifying the Kernel configuration and recompiling it without the SRv6 HMAC feature enabled. However, this workaround may not be feasible for all scenarios and it is recommended to apply the official fix by updating the Kernel to the patched version.
Conclusion
The vulnerability in the Linux Kernel's IPv6 networking subsystem, specifically the __init-annotated seg6_hmac_net_init() function, could potentially allow an attacker to execute arbitrary code or cause a denial-of-service (DoS) attack. It is crucial to update the Kernel to version 5.15.53 or later to mitigate this vulnerability. Alternatively, users can disable the SRv6 HMAC networking feature as a temporary workaround. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability could potentially allow an attacker to execute arbitrary code or cause a denial-of-service (DoS) attack by exploiting the SRv6 HMAC networking feature in the Linux Kernel.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file and the Vulert Playground will analyze it for any open-source vulnerabilities, including this one.
At the time of this report, there is no known public exploit for this vulnerability. However, it is important to apply the fix as soon as possible to mitigate any potential risks.
Yes, this vulnerability can be exploited remotely if the affected system is accessible over a network. It is important to update the Kernel to the patched version to prevent any potential remote exploitation.
Apart from updating the Kernel to the patched version, disabling the SRv6 HMAC networking feature can serve as a temporary mitigation. However, it is recommended to apply the official fix as soon as possible.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
