High · published May 17, 2024
In the Linux kernel, the following vulnerability has been resolved:
icmp: prevent possible NULL dereferences from icmp_build_probe()
First problem is a double call to __in_dev_get_rcu(), because
the second one could return NULL.
if (__in_dev_get_rcu(dev) && __in_dev_get_rcu(dev)->ifa_list)
Second problem is a read from dev->ip6_ptr with no NULL check:
if (!list_empty(&rcu_dereference(dev->ip6_ptr)->addr_list))
Use the correct RCU API to fix these.
v2: add missing include <net/addrconf.h>
| Product | Versions | Fixed in |
|---|---|---|
| linux/linux_kernel | ≥ 5.13, < 5.15.158 | 5.15.158 |
| linux/linux_kernel | ≥ 5.16, < 6.1.90 | 6.1.90 |
| linux/linux_kernel | ≥ 6.2, < 6.6.30 | 6.6.30 |
| linux/linux_kernel | ≥ 6.7, < 6.8.9 | 6.8.9 |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |