In the Linux kernel, the following vulnerability has been resolved:
ipv6: prevent possible NULL deref in fib6nhinit()
syzbot reminds us that in6devget() can return NULL.
fib6nhinit() ip6validategw( &idev ) ip6routechecknh( idev ) *idev = in6dev_get(dev); // can be NULL
Oops: general protection fault, probably for non-canonical address 0xdffffc00000000bc: 0000 [#1] PREEMPT SMP KASAN PTI KASAN: null-ptr-deref in range [0x00000000000005e0-0x00000000000005e7] CPU: 0 PID: 11237 Comm: syz-executor.3 Not tainted 6.10.0-rc2-syzkaller-00249-gbe27b8965297 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024 RIP: 0010:fib6nhinit+0x640/0x2160 net/ipv6/route.c:3606 Code: 00 00 fc ff df 4c 8b 64 24 58 48 8b 44 24 28 4c 8b 74 24 30 48 89 c1 48 89 44 24 28 48 8d 98 e0 05 00 00 48 89 d8 48 c1 e8 03 <42> 0f b6 04 38 84 c0 0f 85 b3 17 00 00 8b 1b 31 ff 89 de e8 b8 8b RSP: 0018:ffffc900032775a0 EFLAGS: 00010202 RAX: 00000000000000bc RBX: 00000000000005e0 RCX: 0000000000000000 RDX: 0000000000000010 RSI: ffffc90003277a54 RDI: ffff88802b3a08d8 RBP: ffffc900032778b0 R08: 00000000000002fc R09: 0000000000000000 R10: 00000000000002fc R11: 0000000000000000 R12: ffff88802b3a08b8 R13: 1ffff9200064eec8 R14: ffffc90003277a00 R15: dffffc0000000000 FS: 00007f940feb06c0(0000) GS:ffff8880b9400000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 00000000245e8000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> ip6routeinfocreate+0x99e/0x12b0 net/ipv6/route.c:3809 ip6routeadd+0x28/0x160 net/ipv6/route.c:3853 ipv6routeioctl+0x588/0x870 net/ipv6/route.c:4483 inet6ioctl+0x21a/0x280 net/ipv6/afinet6.c:579 sockdoioctl+0x158/0x460 net/socket.c:1222 sockioctl+0x629/0x8e0 net/socket.c:1341 vfsioctl fs/ioctl.c:51 [inline] _dosysioctl fs/ioctl.c:907 [inline] _sesysioctl+0xfc/0x170 fs/ioctl.c:893 dosyscallx64 arch/x86/entry/common.c:52 [inline] dosyscall64+0xf3/0x230 arch/x86/entry/common.c:83 entrySYSCALL64after_hwframe+0x77/0x7f RIP: 0033:0x7f940f07cea9
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@de5ad4d45cd0128a2a37555f48ab69aa19d78adc",
"digest": {
"threshold": 0.9,
"line_hashes": [
"260404886271800911995343987320947549442",
"27613798027825362325240463274055805395",
"55650341120004557413683269665836299960",
"267698832633580105537793365670376441458"
]
},
"target": {
"file": "net/ipv6/route.c"
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"id": "CVE-2024-40961-10baf348"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3200ffeec4d59aad5bc9ca75d2c1fae47c0aeade",
"digest": {
"threshold": 0.9,
"line_hashes": [
"260404886271800911995343987320947549442",
"27613798027825362325240463274055805395",
"55650341120004557413683269665836299960",
"267698832633580105537793365670376441458"
]
},
"target": {
"file": "net/ipv6/route.c"
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"id": "CVE-2024-40961-2f4d3857"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@88b9a55e2e35ea846d41f4efdc29d23345bd1aa4",
"digest": {
"threshold": 0.9,
"line_hashes": [
"260404886271800911995343987320947549442",
"27613798027825362325240463274055805395",
"55650341120004557413683269665836299960",
"267698832633580105537793365670376441458"
]
},
"target": {
"file": "net/ipv6/route.c"
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"id": "CVE-2024-40961-31cd6bde"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b6947723c9eabcab58cfb33cdb0a565a6aee6727",
"digest": {
"threshold": 0.9,
"line_hashes": [
"260404886271800911995343987320947549442",
"27613798027825362325240463274055805395",
"55650341120004557413683269665836299960",
"267698832633580105537793365670376441458"
]
},
"target": {
"file": "net/ipv6/route.c"
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"id": "CVE-2024-40961-3e1a0c04"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@88b9a55e2e35ea846d41f4efdc29d23345bd1aa4",
"digest": {
"length": 2429.0,
"function_hash": "317728985839110988717884389193978273164"
},
"target": {
"function": "fib6_nh_init",
"file": "net/ipv6/route.c"
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"id": "CVE-2024-40961-4ca39a11"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2eab4543a2204092c3a7af81d7d6c506e59a03a6",
"digest": {
"length": 2462.0,
"function_hash": "293107129539126950196773589760276590040"
},
"target": {
"function": "fib6_nh_init",
"file": "net/ipv6/route.c"
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"id": "CVE-2024-40961-605a8e1a"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ae8d3d39efe366c2198f530e01e4bf07830bf403",
"digest": {
"threshold": 0.9,
"line_hashes": [
"260404886271800911995343987320947549442",
"27613798027825362325240463274055805395",
"55650341120004557413683269665836299960",
"267698832633580105537793365670376441458"
]
},
"target": {
"file": "net/ipv6/route.c"
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"id": "CVE-2024-40961-82622fc2"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3200ffeec4d59aad5bc9ca75d2c1fae47c0aeade",
"digest": {
"length": 2249.0,
"function_hash": "295847017828865736772731539394823519144"
},
"target": {
"function": "fib6_nh_init",
"file": "net/ipv6/route.c"
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"id": "CVE-2024-40961-876f0956"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2eab4543a2204092c3a7af81d7d6c506e59a03a6",
"digest": {
"threshold": 0.9,
"line_hashes": [
"260404886271800911995343987320947549442",
"27613798027825362325240463274055805395",
"55650341120004557413683269665836299960",
"267698832633580105537793365670376441458"
]
},
"target": {
"file": "net/ipv6/route.c"
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"id": "CVE-2024-40961-bb5f210a"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ae8d3d39efe366c2198f530e01e4bf07830bf403",
"digest": {
"length": 2462.0,
"function_hash": "293107129539126950196773589760276590040"
},
"target": {
"function": "fib6_nh_init",
"file": "net/ipv6/route.c"
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"id": "CVE-2024-40961-c1afabb2"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@de5ad4d45cd0128a2a37555f48ab69aa19d78adc",
"digest": {
"length": 2381.0,
"function_hash": "223211458630964839562615328595698406280"
},
"target": {
"function": "fib6_nh_init",
"file": "net/ipv6/route.c"
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"id": "CVE-2024-40961-e02dd064"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b6947723c9eabcab58cfb33cdb0a565a6aee6727",
"digest": {
"length": 2462.0,
"function_hash": "293107129539126950196773589760276590040"
},
"target": {
"function": "fib6_nh_init",
"file": "net/ipv6/route.c"
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"id": "CVE-2024-40961-e68cead4"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4cdfe813015d5a24586bd0a84fa0fa6eb0a1f668",
"digest": {
"length": 2370.0,
"function_hash": "32464462780137179568846219538228094878"
},
"target": {
"function": "fib6_nh_init",
"file": "net/ipv6/route.c"
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"id": "CVE-2024-40961-ea4e0e9d"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4cdfe813015d5a24586bd0a84fa0fa6eb0a1f668",
"digest": {
"threshold": 0.9,
"line_hashes": [
"260404886271800911995343987320947549442",
"27613798027825362325240463274055805395",
"55650341120004557413683269665836299960",
"267698832633580105537793365670376441458"
]
},
"target": {
"file": "net/ipv6/route.c"
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"id": "CVE-2024-40961-f63ce1c0"
}
]