Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1020 CNY

100%
Buy Us a Coffee

CVE-2024-40905— ipv6: fix possible race in __fib6_drop_pcpu_from()

EPSS 0.01% · P1

Affected Version Matrix 16

VendorProductVersion RangeStatus
LinuxLinuxd52d3997f843ffefaa8d8462790ffcaca6c74192< c90af1cced2f669a7b2304584be4ada495eaa0e5affected
d52d3997f843ffefaa8d8462790ffcaca6c74192< c693698787660c97950bc1f93a8dd19d8307153daffected
d52d3997f843ffefaa8d8462790ffcaca6c74192< a0bc020592b54a8f3fa2b7f244b6e39e526c2e12affected
d52d3997f843ffefaa8d8462790ffcaca6c74192< 2498960dac9b6fc49b6d1574f7cd1a4872744adfaffected
d52d3997f843ffefaa8d8462790ffcaca6c74192< 7e796c3fefa8b17b30e7252886ae8cffacd2b9efaffected
d52d3997f843ffefaa8d8462790ffcaca6c74192< 09e5a5a80e205922151136069e440477d6816914affected
d52d3997f843ffefaa8d8462790ffcaca6c74192< b01e1c030770ff3b4fe37fc7cc6bca03f594133faffected
4.2affected
… +8 more rows
Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2024-40905

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
ipv6: fix possible race in __fib6_drop_pcpu_from()
Source: NVD (National Vulnerability Database)
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: ipv6: fix possible race in __fib6_drop_pcpu_from() syzbot found a race in __fib6_drop_pcpu_from() [1] If compiler reads more than once (*ppcpu_rt), second read could read NULL, if another cpu clears the value in rt6_get_pcpu_route(). Add a READ_ONCE() to prevent this race. Also add rcu_read_lock()/rcu_read_unlock() because we rely on RCU protection while dereferencing pcpu_rt. [1] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000012: 0000 [#1] PREEMPT SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000090-0x0000000000000097] CPU: 0 PID: 7543 Comm: kworker/u8:17 Not tainted 6.10.0-rc1-syzkaller-00013-g2bfcfd584ff5 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024 Workqueue: netns cleanup_net RIP: 0010:__fib6_drop_pcpu_from.part.0+0x10a/0x370 net/ipv6/ip6_fib.c:984 Code: f8 48 c1 e8 03 80 3c 28 00 0f 85 16 02 00 00 4d 8b 3f 4d 85 ff 74 31 e8 74 a7 fa f7 49 8d bf 90 00 00 00 48 89 f8 48 c1 e8 03 <80> 3c 28 00 0f 85 1e 02 00 00 49 8b 87 90 00 00 00 48 8b 0c 24 48 RSP: 0018:ffffc900040df070 EFLAGS: 00010206 RAX: 0000000000000012 RBX: 0000000000000001 RCX: ffffffff89932e16 RDX: ffff888049dd1e00 RSI: ffffffff89932d7c RDI: 0000000000000091 RBP: dffffc0000000000 R08: 0000000000000005 R09: 0000000000000007 R10: 0000000000000001 R11: 0000000000000006 R12: ffff88807fa080b8 R13: fffffbfff1a9a07d R14: ffffed100ff41022 R15: 0000000000000001 FS: 0000000000000000(0000) GS:ffff8880b9200000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000001b32c26000 CR3: 000000005d56e000 CR4: 00000000003526f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> __fib6_drop_pcpu_from net/ipv6/ip6_fib.c:966 [inline] fib6_drop_pcpu_from net/ipv6/ip6_fib.c:1027 [inline] fib6_purge_rt+0x7f2/0x9f0 net/ipv6/ip6_fib.c:1038 fib6_del_route net/ipv6/ip6_fib.c:1998 [inline] fib6_del+0xa70/0x17b0 net/ipv6/ip6_fib.c:2043 fib6_clean_node+0x426/0x5b0 net/ipv6/ip6_fib.c:2205 fib6_walk_continue+0x44f/0x8d0 net/ipv6/ip6_fib.c:2127 fib6_walk+0x182/0x370 net/ipv6/ip6_fib.c:2175 fib6_clean_tree+0xd7/0x120 net/ipv6/ip6_fib.c:2255 __fib6_clean_all+0x100/0x2d0 net/ipv6/ip6_fib.c:2271 rt6_sync_down_dev net/ipv6/route.c:4906 [inline] rt6_disable_ip+0x7ed/0xa00 net/ipv6/route.c:4911 addrconf_ifdown.isra.0+0x117/0x1b40 net/ipv6/addrconf.c:3855 addrconf_notify+0x223/0x19e0 net/ipv6/addrconf.c:3778 notifier_call_chain+0xb9/0x410 kernel/notifier.c:93 call_netdevice_notifiers_info+0xbe/0x140 net/core/dev.c:1992 call_netdevice_notifiers_extack net/core/dev.c:2030 [inline] call_netdevice_notifiers net/core/dev.c:2044 [inline] dev_close_many+0x333/0x6a0 net/core/dev.c:1585 unregister_netdevice_many_notify+0x46d/0x19f0 net/core/dev.c:11193 unregister_netdevice_many net/core/dev.c:11276 [inline] default_device_exit_batch+0x85b/0xae0 net/core/dev.c:11759 ops_exit_list+0x128/0x180 net/core/net_namespace.c:178 cleanup_net+0x5b7/0xbf0 net/core/net_namespace.c:640 process_one_work+0x9fb/0x1b60 kernel/workqueue.c:3231 process_scheduled_works kernel/workqueue.c:3312 [inline] worker_thread+0x6c8/0xf70 kernel/workqueue.c:3393 kthread+0x2c1/0x3a0 kernel/kthread.c:389 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel 存在安全漏洞，该漏洞源于 ipv6 组件在 fib6_drop_pcpu_from 函数中存在潜在的竞争条件问题，可能导致空指针取消引用。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

VendorProductAffected VersionsCPESubscribe
LinuxLinux d52d3997f843ffefaa8d8462790ffcaca6c74192 ~ c90af1cced2f669a7b2304584be4ada495eaa0e5 -
LinuxLinux 4.2 -

II. Public POCs for CVE-2024-40905

#POC DescriptionSource LinkShenlong Link
AI-Generated POCPremium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2024-40905

请登录查看更多情报信息。

Same Patch Batch · Linux · 2024-07-12 · 122 CVEs total

CVE-2024-40960ipv6: prevent possible NULL dereference in rt6_probe()
CVE-2024-40975platform/x86: x86-android-tablets: Unregister devices in reverse order
CVE-2024-40974powerpc/pseries: Enforce hcall result buffer validity and size
CVE-2024-40973media: mtk-vcodec: potential null pointer deference in SCP
CVE-2024-40972ext4: do not create EA inode under buffer lock
CVE-2024-40970Avoid hw_desc array overrun in dw-axi-dmac
CVE-2024-40971f2fs: remove clear SB_INLINECRYPT flag in default_options
CVE-2024-40969f2fs: don't set RO when shutting down f2fs
CVE-2024-40967serial: imx: Introduce timeout when waiting on transmitter empty
CVE-2024-40968MIPS: Octeon: Add PCIe link status check
CVE-2024-40966tty: add the option to have a tty reject a new ldisc
CVE-2024-40965i2c: lpi2c: Avoid calling clk_get_rate during transfer
CVE-2024-40964ALSA: hda: cs35l41: Possible null pointer dereference in cs35l41_hda_unbind()
CVE-2024-40963mips: bmips: BCM6358: make sure CBR is correctly set
CVE-2024-40961ipv6: prevent possible NULL deref in fib6_nh_init()
CVE-2024-40962btrfs: zoned: allocate dummy checksums for zoned NODATASUM writes
CVE-2024-40951ocfs2: fix NULL pointer dereference in ocfs2_abort_trigger()
CVE-2024-40950mm: huge_memory: fix misused mapping_large_folio_support() for anon folios
CVE-2024-40949mm: shmem: fix getting incorrect lruvec when replacing a shmem folio
CVE-2024-40952ocfs2: fix NULL pointer dereference in ocfs2_journal_dirty()

Showing top 20 of 122 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2024-40905

No comments yet

Leave a comment