In the Linux kernel, the following vulnerability has been resolved:
ipv6: fix fib6 walker UAF on seq stop
ipv6_route_iter_active() treats a walker in FWS_U at the table root as
already unlinked. fib6_del_route() can move a still-linked walker into
that same state when the current leaf is the last route at the root,
so ipv6_route_native_seq_stop() skips fib6_walker_unlink(). The seq
private object can then be freed while it remains on
net->ipv6.fib6_walkers. A later route deletion walks the dangling list
and uses the freed walker.
Use the list head as membership state and reinitialize it when
unlinking. Keep the existing w->node check so a never-started iterator
with a zeroed private object is not treated as linked.
The same stop helper is used by /proc/net/ipv6_route and by the BPF
ipv6_route iterator. The BPF show path only widens the race.
CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 7.8
AV:L - The bug is reached by a local read() of /proc/net/ipv6_route (ipv6_route_native_seq_stop via ipv6_route_seq_ops, or the BPF ipv6_route iterator) racing a local RTM_DELROUTE netlink request that runs fib6_del_route(). No remote protocol supplies data that causes the missed fib6_walker_unlink().
AC:L - The attacker controls both sides of the race. One thread reads /proc/net/ipv6_route while another repeatedly adds and deletes the last route in the table root (e.g. ::/0), which moves the linked walker to FWS_U at the root so seq_stop skips the unlink. The attempt can be retried freely.
PR:L - /proc/net/ipv6_route is created with mode 0 (0444, world-readable). Deleting routes needs CAP_NET_ADMIN only over the namespace, which an unprivileged user gets with unshare -Urn, and net->ipv6.fib6_walkers is per-namespace, so the whole attack runs in an attacker-owned netns.
UI:N - No victim action is needed. The attacker opens, reads and closes the proc file and issues the route deletions themselves.
S:U - The use-after-free happens in kernel heap memory and gives kernel-level impact within the same security authority. No VM or hardware isolation boundary is crossed.
C:H - The freed seq_file private object (struct ipv6_route_iter, holding the fib6_walker) stays on net->ipv6.fib6_walkers. Later FOR_WALKERS loops read w->state, w->leaf and w->node from memory the attacker can reallocate with controlled contents, a UAF usable for kernel memory disclosure.
I:H - fib6_del_route() and fib6_repair_tree() write w->leaf, w->state and w->node into the freed walker, and list_add/list_del on w->lh write pointers into it. That is a write primitive into a reallocated kernel heap object, usable for corruption and privilege escalation.
A:H - Any later route deletion or tree repair in that namespace walks the dangling fib6_walkers entry, which causes list corruption or a KASAN/oops crash of the kernel.
| Attack Vector |
Local |
Scope |
Unchanged |
| Attack Complexity |
Low |
Confidentiality Impact |
High |
| Privileges Required |
Low |
Integrity Impact |
High |
| User Interaction |
None |
Availability Impact |
High |
AV:L - The bug is reached by a local read() of /proc/net/ipv6_route (ipv6_route_native_seq_stop via ipv6_route_seq_ops, or the BPF ipv6_route iterator) racing a local RTM_DELROUTE netlink request that runs fib6_del_route(). No remote protocol supplies data that causes the missed fib6_walker_unlink().
AC:L - The attacker controls both sides of the race. One thread reads /proc/net/ipv6_route while another repeatedly adds and deletes the last route in the table root (e.g. ::/0), which moves the linked walker to FWS_U at the root so seq_stop skips the unlink. The attempt can be retried freely.
PR:L - /proc/net/ipv6_route is created with mode 0 (0444, world-readable). Deleting routes needs CAP_NET_ADMIN only over the namespace, which an unprivileged user gets with unshare -Urn, and net->ipv6.fib6_walkers is per-namespace, so the whole attack runs in an attacker-owned netns.
UI:N - No victim action is needed. The attacker opens, reads and closes the proc file and issues the route deletions themselves.
S:U - The use-after-free happens in kernel heap memory and gives kernel-level impact within the same security authority. No VM or hardware isolation boundary is crossed.
C:H - The freed seq_file private object (struct ipv6_route_iter, holding the fib6_walker) stays on net->ipv6.fib6_walkers. Later FOR_WALKERS loops read w->state, w->leaf and w->node from memory the attacker can reallocate with controlled contents, a UAF usable for kernel memory disclosure.
I:H - fib6_del_route() and fib6_repair_tree() write w->leaf, w->state and w->node into the freed walker, and list_add/list_del on w->lh write pointers into it. That is a write primitive into a reallocated kernel heap object, usable for corruption and privilege escalation.
A:H - Any later route deletion or tree repair in that namespace walks the dangling fib6_walkers entry, which causes list corruption or a KASAN/oops crash of the kernel.
CVSS 3.1