In the Linux kernel, the following vulnerability has been resolved:
ipv6: ioam: fix type confusion of dst_entry
IOAM uses a dummy dst_entry(null_dst) to mark that the destination should
not be changed after the transformation. This dst is stored in the IOAM lwt
state and may be passed to dst_cache_set_ip6().
However, the IPv6 dst cache path eventually calls rt6_get_cookie(), which
treats the dst_entry as part of a struct rt6_info. Since the null_dst was
embedded directly as a struct dst_entry in struct ioam6_lwt, this resulted
in an invalid cast and rt6_get_cookie() reading fields from the wrong
object.
In practice, the wrong cookie is not used while dst->obsolete is zero, but
rt6_get_cookie() may also access per-cpu value when rt->sernum is
zero. In this case, rt->sernum aliases ioam6_lwt::cache::reset_ts, which
can become zero, making this a potential invalid pointer access.
Fix this by embedding a full struct rt6_info for the dummy IPv6 route and
passing its dst member to the dst APIs.
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 9.8
AV:N - The flaw is in ioam6_output() on the IPv6 transmit path (lwtunnel_output→dst_output), reachable when remotely sourced IPv6 packets are forwarded or locally output through an IOAM6 LWT route on internet-facing or LAN routers.
AC:L - Once IOAM6 LWT inline routes exist, an attacker can reliably trigger the null_dst dst_cache_set_ip6() path by sending IPv6 traffic that misses the per-CPU dst cache, without races or uncontrollable memory layout.
PR:N - Exploitation requires only the ability to send IPv6 packets; IOAM6 LWT route and namespace setup needs CAP_NET_ADMIN on the victim but is an operator deployment prerequisite, not attacker privilege.
UI:N - No victim user action is required beyond normal network operation; crafted or high-volume IPv6 packets alone drive the vulnerable output path.
S:U - Impact is kernel memory corruption and crash within the host kernel; it does not cross VM, container, or IOMMU security boundaries.
C:H - Type confusion makes rt6_get_cookie() treat ioam6_lwt fields as rt6_info members and chase a misinterpreted fib6_info pointer via fib6_get_cookie_safe(), enabling out-of-bounds kernel memory reads.
I:H - Casting a standalone dst_entry to rt6_info is type confusion that corrupts pointer interpretation and dst_cache cookie state, a class exploitable toward arbitrary kernel writes or control-flow hijack.
A:H - The confused rt6_info layout can dereference invalid fib6_info/fib6_node pointers, causing kernel oops or panic; memory corruption in the networking fast path also risks host-wide denial of service.
| Attack Vector |
Network |
Scope |
Unchanged |
| Attack Complexity |
Low |
Confidentiality Impact |
High |
| Privileges Required |
None |
Integrity Impact |
High |
| User Interaction |
None |
Availability Impact |
High |
AV:N - The flaw is in ioam6_output() on the IPv6 transmit path (lwtunnel_output→dst_output), reachable when remotely sourced IPv6 packets are forwarded or locally output through an IOAM6 LWT route on internet-facing or LAN routers.
AC:L - Once IOAM6 LWT inline routes exist, an attacker can reliably trigger the null_dst dst_cache_set_ip6() path by sending IPv6 traffic that misses the per-CPU dst cache, without races or uncontrollable memory layout.
PR:N - Exploitation requires only the ability to send IPv6 packets; IOAM6 LWT route and namespace setup needs CAP_NET_ADMIN on the victim but is an operator deployment prerequisite, not attacker privilege.
UI:N - No victim user action is required beyond normal network operation; crafted or high-volume IPv6 packets alone drive the vulnerable output path.
S:U - Impact is kernel memory corruption and crash within the host kernel; it does not cross VM, container, or IOMMU security boundaries.
C:H - Type confusion makes rt6_get_cookie() treat ioam6_lwt fields as rt6_info members and chase a misinterpreted fib6_info pointer via fib6_get_cookie_safe(), enabling out-of-bounds kernel memory reads.
I:H - Casting a standalone dst_entry to rt6_info is type confusion that corrupts pointer interpretation and dst_cache cookie state, a class exploitable toward arbitrary kernel writes or control-flow hijack.
A:H - The confused rt6_info layout can dereference invalid fib6_info/fib6_node pointers, causing kernel oops or panic; memory corruption in the networking fast path also risks host-wide denial of service.
CVSS 3.1