In the Linux kernel, the following vulnerability has been resolved:
ipv4: fib: Don't ignore error route in local/main tables.
When CONFIG_IP_MULTIPLE_TABLES is enabled but no rule is added,
fib_lookup() performs route lookup directly on two tables.
Since the first lookup does not properly bail out, the result
of an error route in the merged local/main table could be
overwritten by another route in the default table:
# unshare -n
# ip link set lo up
# ip route add 192.168.0.0/24 dev lo table 253
# ip route add unreachable 192.168.0.0/24
# ip route get 192.168.0.1
192.168.0.1 dev lo table default uid 0
cache <local>
Once a random rule is added, the error route is respected:
# ip rule add table 0
# ip rule del table 0
# ip route get 192.168.0.1
RTNETLINK answers: No route to host
Let's fix the inconsistent behaviour.
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
CVSS Score: 10
AV:N - fib_lookup() is on the IPv4 receive and transmit datapaths (ip_route_input_rcu, ip_route_output_key, forwarding) reached by remote packets on internet-facing routers, gateways, cloud hosts, and container nodes without any local syscall.
AC:L - Once main/local holds an error route and default has an overlapping prefix (reproduced in the fix commit with basic ip-route commands), any matching packet or socket lookup deterministically hits the bypass; no race or attacker-independent memory layout is required.
PR:N - Overlapping table layout is a deployment/CAP_NET_ADMIN prerequisite, but exploitation only requires sending traffic or using sockets; the remote attacker needs no credentials or privileges on the victim once the vulnerable routing state exists.
UI:N - Route resolution runs automatically in the kernel networking stack during normal packet forwarding and connection setup; no victim mount, click, or file open is needed beyond ordinary network use.
S:C - Bypassing unreachable/prohibit/blackhole routes can defeat network-namespace/pod egress blackholes and segmentation boundaries on multi-tenant hosts and routers, allowing access outside the intended isolated security scope.
C:H - Ignored error routes let traffic reach destinations deliberately isolated (internal networks, metadata endpoints, sinkholed ranges), exposing data that routing policy was designed to keep inaccessible.
I:H - Packets that should be dropped or rejected are instead forwarded via the default-table route, enabling injection of traffic into networks marked unreachable, prohibited, or blackhole.
A:N - The defect is incorrect route selection only; it does not corrupt memory, panic the kernel, deadlock, or inherently exhaust resources, so availability impact is none.
| Attack Vector |
Network |
Scope |
Changed |
| Attack Complexity |
Low |
Confidentiality Impact |
High |
| Privileges Required |
None |
Integrity Impact |
High |
| User Interaction |
None |
Availability Impact |
None |
AV:N - fib_lookup() is on the IPv4 receive and transmit datapaths (ip_route_input_rcu, ip_route_output_key, forwarding) reached by remote packets on internet-facing routers, gateways, cloud hosts, and container nodes without any local syscall.
AC:L - Once main/local holds an error route and default has an overlapping prefix (reproduced in the fix commit with basic ip-route commands), any matching packet or socket lookup deterministically hits the bypass; no race or attacker-independent memory layout is required.
PR:N - Overlapping table layout is a deployment/CAP_NET_ADMIN prerequisite, but exploitation only requires sending traffic or using sockets; the remote attacker needs no credentials or privileges on the victim once the vulnerable routing state exists.
UI:N - Route resolution runs automatically in the kernel networking stack during normal packet forwarding and connection setup; no victim mount, click, or file open is needed beyond ordinary network use.
S:C - Bypassing unreachable/prohibit/blackhole routes can defeat network-namespace/pod egress blackholes and segmentation boundaries on multi-tenant hosts and routers, allowing access outside the intended isolated security scope.
C:H - Ignored error routes let traffic reach destinations deliberately isolated (internal networks, metadata endpoints, sinkholed ranges), exposing data that routing policy was designed to keep inaccessible.
I:H - Packets that should be dropped or rejected are instead forwarded via the default-table route, enabling injection of traffic into networks marked unreachable, prohibited, or blackhole.
A:N - The defect is incorrect route selection only; it does not corrupt memory, panic the kernel, deadlock, or inherently exhaust resources, so availability impact is none.
CVSS 3.1