linux-cve-announce - CVE-2021-47515: seg6: fix the iif in the IPv6 socket control block

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2024052431-CVE-2021-47515-5c06@gregkh>
Date: Fri, 24 May 2024 17:09:35 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Subject: CVE-2021-47515: seg6: fix the iif in the IPv6 socket control block

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

seg6: fix the iif in the IPv6 socket control block

When an IPv4 packet is received, the ip_rcv_core(...) sets the receiving
interface index into the IPv4 socket control block (v5.16-rc4,
net/ipv4/ip_input.c line 510):

    IPCB(skb)->iif = skb->skb_iif;

If that IPv4 packet is meant to be encapsulated in an outer IPv6+SRH
header, the seg6_do_srh_encap(...) performs the required encapsulation.
In this case, the seg6_do_srh_encap function clears the IPv6 socket control
block (v5.16-rc4 net/ipv6/seg6_iptunnel.c line 163):

    memset(IP6CB(skb), 0, sizeof(*IP6CB(skb)));

The memset(...) was introduced in commit ef489749aae5 ("ipv6: sr: clear
IP6CB(skb) on SRH ip4ip6 encapsulation") a long time ago (2019-01-29).

Since the IPv6 socket control block and the IPv4 socket control block share
the same memory area (skb->cb), the receiving interface index info is lost
(IP6CB(skb)->iif is set to zero).

As a side effect, that condition triggers a NULL pointer dereference if
commit 0857d6f8c759 ("ipv6: When forwarding count rx stats on the orig
netdev") is applied.

To fix that issue, we set the IP6CB(skb)->iif with the index of the
receiving interface once again.

The Linux kernel CVE team has assigned CVE-2021-47515 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 4.14.98 with commit c630ec8bdada and fixed in 4.14.258 with commit b16d412e5f79
	Issue introduced in 4.19.20 with commit 2f704348c93f and fixed in 4.19.221 with commit 6431e71093f3
	Issue introduced in 5.0 with commit ef489749aae5 and fixed in 5.4.165 with commit ef8804e47c0a
	Issue introduced in 5.0 with commit ef489749aae5 and fixed in 5.10.85 with commit 666521b3852d
	Issue introduced in 5.0 with commit ef489749aae5 and fixed in 5.15.8 with commit 98adb2bbfa40
	Issue introduced in 5.0 with commit ef489749aae5 and fixed in 5.16 with commit ae68d93354e5
	Issue introduced in 4.20.7 with commit b71b7e0280f4

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2021-47515
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/ipv6/seg6_iptunnel.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/b16d412e5f79734033df04e97d7ea2f50a8e9fe3
	https://git.kernel.org/stable/c/6431e71093f3da586a00c6d931481ffb0dc2db0e
	https://git.kernel.org/stable/c/ef8804e47c0a44ae106ead1740408af5ea6c6ee9
	https://git.kernel.org/stable/c/666521b3852d2b2f52d570f9122b1e4b50d96831
	https://git.kernel.org/stable/c/98adb2bbfa407c9290bda299d4c6f7a1c4ebd5e1
	https://git.kernel.org/stable/c/ae68d93354e5bf5191ee673982251864ea24dd5c