netdev - [Bug] "general protection fault in corrupted at " in Linux kernel v6.14 [sock_kmalloc() Null Pointer Dereference via CALIPSO NetLabel Processing in IPv6 SYN Request (IPv6 + SELinux + CALIPSO Path)]

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAP=Rh=MvfhrGADy+-WJiftV2_WzMH4VEhEFmeT28qY+4yxNu4w@mail.gmail.com>
Date: Thu, 22 May 2025 23:41:23 +0800
From: John <john.cs.hey@...il.com>
To: Kuniyuki Iwashima <kuniyu@...zon.com>, Paolo Abeni <pabeni@...hat.com>, 
	Willem de Bruijn <willemb@...gle.com>
Cc: "David S. Miller" <davem@...emloft.net>, Jakub Kicinski <kuba@...nel.org>, 
	Simon Horman <horms@...nel.org>, netdev@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: [Bug] "general protection fault in corrupted at " in Linux kernel
 v6.14 [sock_kmalloc() Null Pointer Dereference via CALIPSO NetLabel
 Processing in IPv6 SYN Request (IPv6 + SELinux + CALIPSO Path)]

Dear Linux Kernel Maintainers,

I hope this message finds you well.

I am writing to report a potential vulnerability I encountered during
testing of the Linux Kernel version v6.14.

Git Commit: 38fec10eb60d687e30c8c6b5420d86e8149f7557 (tag: v6.14)

Bug Location: 0010:sock_kmalloc+0x35/0x170 net/core/sock.c:2806

Bug report: https://hastebin.com/share/vewamacadi.bash

Complete log: https://hastebin.com/share/otoxiberok.perl

Entire kernel config: https://pastebin.com/MRWGr3nv

Root Cause Analysis:
A NULL pointer dereference occurs in sock_kmalloc() at
net/core/sock.c:2806 due to a missing check for the validity of the sk
pointer.
The function attempts to retrieve the associated network namespace
using sock_net(sk), which internally accesses sk->__sk_common.skc_net
via read_pnet().
However, in the specific code path triggered by an incoming IPv6 TCP
SYN packet with NetLabel/CALIPSO security attributes, the sk structure
is either NULL or uninitialized, resulting in a general protection
fault.
The vulnerability is triggered via the SELinux NetLabel connection
request hook and affects systems with IPv6 + SELinux + CALIPSO
enabled.

At present, I have not yet obtained a minimal reproducer for this
issue. However, I am actively working on reproducing it, and I will
promptly share any additional findings or a working reproducer as soon
as it becomes available.

Thank you very much for your time and attention to this matter. I
truly appreciate the efforts of the Linux kernel community.

Best regards,
John