Acquire RTNL before calling ip[6]mr_free_table() on failure path in Kernel
Summary
GSD-2022-1000373: ipmr,ip6mr: acquire RTNL before calling ip[6]mr_free_table() on failure path. Affects Kernel versions >= f243e5a7859a24d10975afb9a1708cac624ba6f1, < 09ac0fcb0a82d647f2c61d3d488d367b7ee5bd51. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Kernel is a crucial component of the Linux operating system that provides core functionality and acts as an interface between hardware and software. It manages system resources, facilitates communication between different software components, and ensures the overall stability and security of the system. The Kernel includes various subsystems, such as networking, file systems, and device drivers, which are responsible for specific functionalities.
One of the subsystems in the Kernel is the IP Multicast Routing (ipmr) and IPv6 Multicast Routing (ip6mr). These subsystems handle multicast routing, which allows efficient communication between multiple hosts in a network. The ipmr and ip6mr modules provide the necessary functionality for managing multicast routing tables and handling multicast packets.
However, a vulnerability has been discovered in the ipmr and ip6mr modules, where the RTNL (Routing Netlink) lock is not acquired before calling the ip[6]mr_free_table() function on the failure path. This can lead to a race condition and potential memory corruption if multiple threads or processes attempt to access the routing table concurrently. An attacker could potentially exploit this vulnerability to cause a denial-of-service (DoS) condition or execute arbitrary code with elevated privileges.
Vulnerability Detail
The vulnerability arises from the failure to acquire the RTNL lock before calling the ip[6]mr_free_table() function in the ipmr and ip6mr modules. The RTNL lock is a synchronization mechanism used to protect access to the routing table and ensure consistency.
When the ip[6]mr_free_table() function is called without acquiring the RTNL lock, it can result in a race condition where multiple threads or processes may simultaneously access and modify the routing table. This can lead to memory corruption, crashes, or other undefined behavior.
An attacker who can trigger this vulnerability could potentially exploit it to disrupt network communication, cause a DoS condition, or execute arbitrary code with elevated privileges. The impact and attack plausibility of this vulnerability have not been proven yet, but it is considered a security risk that should be addressed.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can avoid triggering the vulnerability by not using the ipmr and ip6mr modules or disabling multicast routing functionality if it is not required. This can be achieved by unloading the relevant kernel modules or configuring the system to exclude the ipmr and ip6mr modules from loading.
Please note that this workaround may impact the functionality of applications or services that rely on multicast routing. It is recommended to consult with network administrators or system integrators before applying this workaround.
Conclusion
The vulnerability in the ipmr and ip6mr modules of the Linux Kernel, where the RTNL lock is not acquired before calling the ip[6]mr_free_table() function on the failure path, can potentially lead to memory corruption, crashes, or the execution of arbitrary code with elevated privileges. It is recommended to update to the fixed version of the Linux Kernel (v5.10.101 or later) that includes the necessary fix. Alternatively, users can apply the mentioned workaround if multicast routing functionality is not required. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The impact of this vulnerability can vary depending on the specific system configuration and usage. It could potentially lead to a denial-of-service (DoS) condition, memory corruption, crashes, or the execution of arbitrary code with elevated privileges.
You can use tools like Vulert (https://vulert.com) to check if your system is affected by this vulnerability. Vulert uses a manifest file like package-lock.json to monitor and alert in real-time for open-source vulnerabilities in the software. You can visit the Vulert playground (https://vulert.com/scanner) without any signup to check if your application is affected.
There is no evidence or reports of this vulnerability being exploited in the wild at the time of this advisory. However, it is always recommended to apply security patches and updates to mitigate potential risks.
Yes, as mentioned in the advisory, users can avoid triggering the vulnerability by not using the ipmr and ip6mr modules or disabling multicast routing functionality if it is not required. However, this may impact the functionality of applications or services that rely on multicast routing.
For more information about this vulnerability, you can refer to the official Linux Kernel security advisories, relevant CVE entries, or consult with the Linux distribution or Kernel maintainers.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
