CVE-2021-47572

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: nexthop: fix null pointer dereference when IPv6 is not enabled

When we try to add an IPv6 nexthop and IPv6 is not enabled

(!CONFIG_IPV6) we'll hit a NULL pointer dereference[1] in the error path

of nh_create_ipv6() due to calling ipv6_stub->fib6_nh_release. The bug

has been present since the beginning of IPv6 nexthop gateway support.

Commit 1aefd3de7bc6 ("ipv6: Add fib6_nh_init and release to stubs") tells

us that only fib6_nh_init has a dummy stub because fib6_nh_release should

not be called if fib6_nh_init returns an error, but the commit below added

a call to ipv6_stub->fib6_nh_release in its error path. To fix it return

the dummy stub's -EAFNOSUPPORT error directly without calling

ipv6_stub->fib6_nh_release in nh_create_ipv6()'s error path.

[1]

Output is a bit truncated, but it clearly shows the error.

BUG: kernel NULL pointer dereference, address: 000000000000000000

#PF: supervisor instruction fetch in

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References