CVE-2021-47588

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

sit: do not call ipip6_dev_free() from sit_init_net()

ipip6_dev_free is sit dev->priv_destructor, already called

by register_netdevice() if something goes wrong.

Alternative would be to make ipip6_dev_free() robust against

multiple invocations, but other drivers do not implement this

strategy.

syzbot reported:

dst_release underflow

WARNING: CPU: 0 PID: 5059 at net/core/dst.c:173 dst_release+0xd8/0xe0 net/core/dst.c:173

Modules linked in:

CPU: 1 PID: 5059 Comm: syz-executor.4 Not tainted 5.16.0-rc5-syzkaller #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011

RIP: 0010:dst_release+0xd8/0xe0 net/core/dst.c:173

Code: 4c 89 f2 89 d9 31 c0 5b 41 5e 5d e9 da d5 44 f9 e8 1d 90 5f f9 c6 05 87 48 c6 05 01 48 c7 c7 80 44 99 8b 31 c0 e8 e8 67 29 f9 <0f> 0b eb 85 0f 1f 40 00 53 48 89 fb e8 f7 8f 5f f9 48 83 c3 a8 48

RSP: 0018:ffffc9000aa5faa0 EFLAGS: 00010246

RAX: d6894a925dd15a00 RBX:

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References