In the Linux kernel, the following vulnerability has been resolved:
net: ipv6: clear suppressed fib6 rule result
fib6_rule_suppress() drops a suppressed route with ip6_rt_put_flags(),
but leaves res->rt6 pointing at the released rt6_info. If no later rule supplies a replacement, fib6_rule_lookup() still sees
res.rt6 and returns that stale dst to its caller. A suppressing rule can
therefore leak a released route back to rt6_lookup(), and the next put
hits rcuref_put_slowpath() from dst_release().
Clear res->rt6 when suppressing the route so suppressed lookups fall through to the null dst instead of reusing the released one.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Privileges Required
None
No privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
High
Complete data modification
Availability
High
Complete denial of service
CVSS Vector v3.1
References 8
https://git.kernel.org/stable/c/354db6243eca59e9d187ffbf8b7955b044ce84dc
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/5d29b286c9de0b309e94b9ed083aa1a2f429434f
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/6aea62e433fe1b586202a5fee8b5807ce635e1d7
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/6d98c70fe0ba8c7708bfd5b2a5174d2086775daa
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/90c57310e266eb94e4a80d6b15a9ca131d2e82cb
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/9bad152c42b37499162367fe47867411e62fffa3
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/a341c091ca0bfae377747b1b59a3bd8ebe18a937
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/dc3ab04220667f254f4348572b2a0b3febff89fb
416baaa9-dc9f-4396-8d5f-8c081fb06d67