Information has been revealed about the CVE-2023-6200 vulnerability in the Linux kernel's network stack, which under certain circumstances allows an attacker from the local network to execute their code by sending a specially crafted ICMPv6 packet with an RA (Router Advertisement) message intended to announce router information.
The vulnerability can only be exploited from the local network and manifests in systems with IPv6 support enabled and the active sysctl parameter 'net.ipv6.conf..accept_ra' (which can be checked with the command 'sysctl net.ipv6.conf| grep accept_ra'), which is disabled by default in RHEL and Ubuntu for external network interfaces but enabled for the loopback interface, allowing an attack from the same system.
The vulnerability is caused by a race condition when the garbage collector processes outdated entries in fib6_info, which can lead to accessing already freed memory (use-after-free). When receiving an ICMPv6 packet with a router advertisement (RA) message, the network stack calls the ndisc_router_discovery() function, which, if the RA message contains route lifetime data, calls the fib6_set_expires() function and fills the gc_link structure. The function fib6_clean_expires() is used to clean up outdated entries, which detaches the entry in gc_link and clears the memory used by the fib6_info structure. At this moment, there is a certain point where the memory for the fib6_info structure has already been freed, but the reference to it remains in the gc_link structure.
The vulnerability manifests starting from version 6.6 and has been fixed in versions 6.6.9 and 6.7. The status of the vulnerability's removal in various distributions can be assessed on the following pages: Debian, Ubuntu, SUSE, RHEL, Fedora, Arch Linux, Gentoo, Slackware. Notable distributions shipping packages with kernel 6.6 include Arch Linux, Gentoo, Fedora, Slackware, OpenMandriva, and Manjaro; in other distributions, backporting the faulty change to packages with older kernel branches is not ruled out (for example, Debian mentions that a vulnerable package with kernel 6.5.13 exists, while the problematic change appeared in branch 6.6). As a workaround for protection, IPv6 can be disabled or the values of 'net.ipv6.conf.*.accept_ra' parameters can be set to 0.
Source: opennet.ru
