Homepage

NULL Pointer Dereference Affecting kernel-64k-debug-modules-core package, versions <0:5.14.0-427.33.1.el9_4

Severity

 Recommended
high

Based on Red Hat Enterprise Linux security rating.

Threat Intelligence

EPSS
0.04% (6th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about NULL Pointer Dereference vulnerabilities in an interactive lesson.

Start learning
  • Snyk IDSNYK-RHEL9-KERNEL64KDEBUGMODULESCORE-7475646
  • published17 Jul 2024
  • disclosed12 Jul 2024
Report a new vulnerability Found a mistake?

Introduced: 12 Jul 2024

CVE-2024-40957  (opens in a new tab)
CWE-476  (opens in a new tab)

How to fix?

Upgrade RHEL:9 kernel-64k-debug-modules-core to version 0:5.14.0-427.33.1.el9_4 or higher.
This issue was patched in RHSA-2024:5928.

NVD Description

Note: Versions mentioned in the description apply only to the upstream kernel-64k-debug-modules-core package and not the kernel-64k-debug-modules-core package as distributed by RHEL. See How to fix? for RHEL:9 relevant fixed versions and status.

In the Linux kernel, the following vulnerability has been resolved:

seg6: fix parameter passing when calling NF_HOOK() in End.DX4 and End.DX6 behaviors

input_action_end_dx4() and input_action_end_dx6() are called NF_HOOK() for PREROUTING hook, in PREROUTING hook, we should passing a valid indev, and a NULL outdev to NF_HOOK(), otherwise may trigger a NULL pointer dereference, as below:

[74830.647293] BUG: kernel NULL pointer dereference, address: 0000000000000090
[74830.655633] #PF: supervisor read access in kernel mode
[74830.657888] #PF: error_code(0x0000) - not-present page
[74830.659500] PGD 0 P4D 0
[74830.660450] Oops: 0000 [#1] PREEMPT SMP PTI
...
[74830.664953] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011
[74830.666569] RIP: 0010:rpfilter_mt+0x44/0x15e [ipt_rpfilter]
...
[74830.689725] Call Trace:
[74830.690402]  &lt;IRQ&gt;
[74830.690953]  ? show_trace_log_lvl+0x1c4/0x2df
[74830.692020]  ? show_trace_log_lvl+0x1c4/0x2df
[74830.693095]  ? ipt_do_table+0x286/0x710 [ip_tables]
[74830.694275]  ? __die_body.cold+0x8/0xd
[74830.695205]  ? page_fault_oops+0xac/0x140
[74830.696244]  ? exc_page_fault+0x62/0x150
[74830.697225]  ? asm_exc_page_fault+0x22/0x30
[74830.698344]  ? rpfilter_mt+0x44/0x15e [ipt_rpfilter]
[74830.699540]  ipt_do_table+0x286/0x710 [ip_tables]
[74830.700758]  ? ip6_route_input+0x19d/0x240
[74830.701752]  nf_hook_slow+0x3f/0xb0
[74830.702678]  input_action_end_dx4+0x19b/0x1e0
[74830.703735]  ? input_action_end_t+0xe0/0xe0
[74830.704734]  seg6_local_input_core+0x2d/0x60
[74830.705782]  lwtunnel_input+0x5b/0xb0
[74830.706690]  __netif_receive_skb_one_core+0x63/0xa0
[74830.707825]  process_backlog+0x99/0x140
[74830.709538]  __napi_poll+0x2c/0x160
[74830.710673]  net_rx_action+0x296/0x350
[74830.711860]  __do_softirq+0xcb/0x2ac
[74830.713049]  do_softirq+0x63/0x90

input_action_end_dx4() passing a NULL indev to NF_HOOK(), and finally trigger a NULL dereference in rpfilter_mt()->rpfilter_is_loopback():

static bool
rpfilter_is_loopback(const struct sk_buff *skb,
                 const struct net_device *in)
{
        // in is NULL
        return skb-&gt;pkt_type == PACKET_LOOPBACK ||
           in-&gt;flags &amp; IFF_LOOPBACK;
}

CVSS Scores

version 3.1