CVE-2023-53343

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

icmp6: Fix null-ptr-deref of ip6_null_entry->rt6i_idev in icmp6_dev().

With some IPv6 Ext Hdr (RPL, SRv6, etc.), we can send a packet that

has the link-local address as src and dst IP and will be forwarded to

an external IP in the IPv6 Ext Hdr.

For example, the script below generates a packet whose src IP is the

link-local address and dst is updated to 11::.

# for f in $(find /proc/sys/net/ -name *seg6_enabled*); do echo 1 > $f; done

# python3

>>> from socket import *

>>> from scapy.all import *

>>>

>>> SRC_ADDR = DST_ADDR = "fe80::5054:ff:fe12:3456"

>>>

>>> pkt = IPv6(src=SRC_ADDR, dst=DST_ADDR)

>>> pkt /= IPv6ExtHdrSegmentRouting(type=4, addresses=["11::", "22::"], segleft=1)

>>>

>>> sk = socket(AF_INET6, SOCK_RAW, IPPROTO_RAW)

>>> sk.sendto(bytes(pkt), (DST_ADDR, 0))

For such a packet, we call ip6_route_input() to look up a route for the

next destination in these three functions dependin

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References