linux-kernel - Re: [Bug] "general protection fault in corrupted at " in Linux kernel v6.14 [sock_kmalloc() Null Pointer Dereference via CALIPSO NetLabel Processing in IPv6 SYN Request (IPv6 + SELinux + CALIPSO Path)]

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20250525070028.79606-1-kuniyu@amazon.com>
Date: Sun, 25 May 2025 00:00:25 -0700
From: Kuniyuki Iwashima <kuniyu@...zon.com>
To: <john.cs.hey@...il.com>
CC: <davem@...emloft.net>, <horms@...nel.org>, <kuba@...nel.org>,
	<kuniyu@...zon.com>, <linux-kernel@...r.kernel.org>,
	<netdev@...r.kernel.org>, <pabeni@...hat.com>, <willemb@...gle.com>
Subject: Re: [Bug] "general protection fault in corrupted at " in Linux kernel v6.14 [sock_kmalloc() Null Pointer Dereference via CALIPSO NetLabel Processing in IPv6 SYN Request (IPv6 + SELinux + CALIPSO Path)]

From: John <john.cs.hey@...il.com>
Date: Thu, 22 May 2025 23:41:23 +0800
> Dear Linux Kernel Maintainers,
> 
> I hope this message finds you well.
> 
> I am writing to report a potential vulnerability I encountered during
> testing of the Linux Kernel version v6.14.
> 
> Git Commit: 38fec10eb60d687e30c8c6b5420d86e8149f7557 (tag: v6.14)
> 
> Bug Location: 0010:sock_kmalloc+0x35/0x170 net/core/sock.c:2806
> 
> Bug report: https://hastebin.com/share/vewamacadi.bash
> 
> Complete log: https://hastebin.com/share/otoxiberok.perl
> 
> Entire kernel config: https://pastebin.com/MRWGr3nv

Thanks for the report.


> 
> Root Cause Analysis:
> A NULL pointer dereference occurs in sock_kmalloc() at
> net/core/sock.c:2806 due to a missing check for the validity of the sk
> pointer.
> The function attempts to retrieve the associated network namespace
> using sock_net(sk), which internally accesses sk->__sk_common.skc_net
> via read_pnet().
> However, in the specific code path triggered by an incoming IPv6 TCP
> SYN packet with NetLabel/CALIPSO security attributes, the sk structure
> is either NULL or uninitialized, resulting in a general protection
> fault.

calipso_req_{set,del}attr() fetches sk by sk_to_full_sk(req_to_sk(req)),
but req->rsk_listener could be NULL in the SYN cookie case.

Here we need to return 0 or an error to avoid the null-ptr-deref.
0 should be avoided as it bypasses LSM, but returning an error
means CALIPSO effectively disables SYN Cookie, but it will be ok
given no user has reported the null-ptr-deref for a decade.

---8<---
diff --git a/net/ipv6/calipso.c b/net/ipv6/calipso.c
index 62618a058b8f..86c26316592b 100644
--- a/net/ipv6/calipso.c
+++ b/net/ipv6/calipso.c
@@ -1207,6 +1207,9 @@ static int calipso_req_setattr(struct request_sock *req,
 	struct ipv6_opt_hdr *old, *new;
 	struct sock *sk = sk_to_full_sk(req_to_sk(req));
 
+	if (!sk)
+		return -ENOENT;
+
 	if (req_inet->ipv6_opt && req_inet->ipv6_opt->hopopt)
 		old = req_inet->ipv6_opt->hopopt;
 	else
@@ -1247,6 +1250,9 @@ static void calipso_req_delattr(struct request_sock *req)
 	struct ipv6_txoptions *txopts;
 	struct sock *sk = sk_to_full_sk(req_to_sk(req));
 
+	if (!sk)
+		return -ENOENT;
+
 	if (!req_inet->ipv6_opt || !req_inet->ipv6_opt->hopopt)
 		return;
 
---8<---



> The vulnerability is triggered via the SELinux NetLabel connection
> request hook and affects systems with IPv6 + SELinux + CALIPSO
> enabled.