Linux Kernel up to 5.1.5 net/ipv6/ipv6_sockglue.c ip6_ra_control new_ra null pointer dereference ⚔ [Disputed]

Summaryinfo

A vulnerability was found in Linux Kernel up to 5.1.5. It has been declared as critical. Affected by this vulnerability is the function ip6_ra_control of the file net/ipv6/ipv6_sockglue.c. Executing a manipulation of the argument new_ra can lead to null pointer dereference. This vulnerability is tracked as CVE-2019-12378. The attack is restricted to local execution. No exploit exists. The real existence of this vulnerability is still doubted at the moment. It is advisable to implement a patch to correct this issue.

Detailsinfo

A vulnerability has been found in Linux Kernel up to 5.1.5 (Operating System) and classified as critical. This vulnerability affects the function ip6_ra_control of the file net/ipv6/ipv6_sockglue.c. The manipulation of the argument new_ra with an unknown input leads to a null pointer dereference vulnerability. The CWE definition for the vulnerability is CWE-476. A NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is NULL, typically causing a crash or exit. As an impact it is known to affect availability. CVE summarizes:

An issue was discovered in ip6_ra_control in net/ipv6/ipv6_sockglue.c in the Linux kernel through 5.1.5. There is an unchecked kmalloc of new_ra, which might allow an attacker to cause a denial of service (NULL pointer dereference and system crash).

The weakness was disclosed 05/28/2019 (Website). The advisory is shared for download at lkml.org. This vulnerability was named CVE-2019-12378 since 05/27/2019. The exploitation appears to be easy. The attack needs to be approached locally. No form of authentication is required for a successful exploitation. There are known technical details, but no exploit is available. Responsible for the vulnerability is the following code:

new_ra = (sel >= 0) ? kmalloc(sizeof(*new_ra), GFP_KERNEL) : NULL;

write_lock_bh(&ip6_ra_lock);
for (rap = &ip6_ra_chain; (ra = *rap) != NULL; rap = &ra->next) {

The real existence of this vulnerability is still doubted at the moment.

Applying a patch is able to eliminate this problem. The bugfix is ready for download at git.kernel.org. A possible mitigation has been published before and not just after the disclosure of the vulnerability. The vulnerability will be addressed with the following lines of code:

if (sel >= 0 && !new_ra)
	return -ENOMEM;

The entries VDB-135656, VDB-135655, VDB-135654 and VDB-135653 are pretty similar. Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 5.1.0
• 5.1.1
• 5.1.2
• 5.1.3
• 5.1.4
• 5.1.5

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion