CVE-2022-49904

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net, neigh: Fix null-ptr-deref in neigh_table_clear()

When IPv6 module gets initialized but hits an error in the middle,

kenel panic with:

KASAN: null-ptr-deref in range [0x0000000000000598-0x000000000000059f]

CPU: 1 PID: 361 Comm: insmod

Hardware name: QEMU Standard PC (i440FX + PIIX, 1996)

RIP: 0010:__neigh_ifdown.isra.0+0x24b/0x370

RSP: 0018:ffff888012677908 EFLAGS: 00000202

...

Call Trace:

<TASK>

neigh_table_clear+0x94/0x2d0

ndisc_cleanup+0x27/0x40 [ipv6]

inet6_init+0x21c/0x2cb [ipv6]

do_one_initcall+0xd3/0x4d0

do_init_module+0x1ae/0x670

...

Kernel panic - not syncing: Fatal exception

When ipv6 initialization fails, it will try to cleanup and calls:

neigh_table_clear()

neigh_ifdown(tbl, NULL)

pneigh_queue_purge(&tbl->proxy_queue, dev_net(dev == NULL))

# dev_net(NULL) triggers null-ptr-deref.

Fix it by passing NULL to pneigh_queue_purge() in neigh_ifdown() if dev

is NULL, to make kernel not pan

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References