{"id":113232,"date":"2024-01-29T18:50:31","date_gmt":"2024-01-29T16:50:31","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-ipv6-steke-yadra-linux-dopuskayushhaya-udalyonnoe-vypolnenie-koda"},"modified":"2024-01-29T18:50:31","modified_gmt":"2024-01-29T16:50:31","slug":"uyazvimost-v-ipv6-steke-yadra-linux-dopuskayushhaya-udalyonnoe-vypolnenie-koda","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/uyazvimost-v-ipv6-steke-yadra-linux-dopuskayushhaya-udalyonnoe-vypolnenie-koda","title":{"rendered":"Vulnerability in the Linux kernel's IPv6 stack allows for remote code execution","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Information has been revealed about the CVE-2023-6200 vulnerability in the Linux kernel's network stack, which under certain circumstances allows an attacker from the local network to execute their code by sending a specially crafted ICMPv6 packet with an RA (Router Advertisement) message intended to announce router information. <\/p>\n
The vulnerability can only be exploited from the local network and manifests in systems with IPv6 support enabled and the active sysctl parameter \"net.ipv6.conf..accept_ra\" (which can be checked with the command \"sysctl net.ipv6.conf | grep accept_ra\"), which is disabled by default in RHEL and Ubuntu for external network interfaces but enabled for the loopback interface, allowing an attack from the same system. <\/p>\n
The vulnerability is caused by a race condition when the garbage collector processes outdated entries in fib6_info, which can lead to accessing already freed memory (use-after-free). When receiving an ICMPv6 packet with a router advertisement (RA) message, the network stack calls the ndisc_router_discovery() function, which, if the RA message contains route lifetime data, calls the fib6_set_expires() function and fills the gc_link structure. The function fib6_clean_expires() is used to clean up outdated entries, which detaches the entry in gc_link and clears the memory used by the fib6_info structure. At this moment, there is a certain point where the memory for the fib6_info structure has already been freed, but the reference to it remains in the gc_link structure. <\/p>\n
The vulnerability appears starting from version 6.6 and is fixed in versions 6.6.9 and 6.7. The status of the vulnerability fix in distributions can be assessed on the following pages: Debian, Ubuntu, SUSE, RHEL, Fedora, Arch Linux, Gentoo, Slackware. Among the distributions that ship with kernel 6.6 packages are Arch Linux, Gentoo, Fedora, Slackware, OpenMandriva, and Manjaro; in other distributions, backporting of the change with the bug in older kernel versions is not ruled out (for example, Debian mentions that the kernel package 6.5.13 is vulnerable, while the problematic change appeared in the 6.6 branch). As a workaround for protection, IPv6 can be disabled or the parameters \"net.ipv6.conf.*.accept_ra\" can be set to 0. \n Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"