Information has been revealed about the CVE-2023-6200 vulnerability in the Linux kernel's network stack, which under certain circumstances allows an attacker from a local network to execute their code by sending a specially crafted ICMPv6 packet containing an RA (Router Advertisement) message intended to announce router information.
The vulnerability can only be exploited from the local network and occurs in systems with IPv6 support enabled and the active sysctl parameter 'net.ipv6.conf..accept_ra' (which can be checked with the command 'sysctl net.ipv6.conf | grep accept_ra'), which is disabled by default in RHEL and Ubuntu for external network interfaces but enabled for the loopback interface, allowing an attack from the same system.
The vulnerability is caused by a race condition in the garbage collector while handling outdated fib6_info records, which may lead to access to already freed memory (use-after-free). Upon receiving an ICMPv6 packet with a router advertisement (RA), the network stack calls the ndisc_router_discovery() function, which upon finding route lifetime data in the RA message calls the fib6_set_expires() function and populates the gc_link structure. The fib6_clean_expires() function is used to clean up outdated records, which detaches the entry from gc_link and frees the memory used by the fib6_info structure. At certain moments, the memory for the fib6_info structure is already freed, but the reference to it still exists in the gc_link structure.
The vulnerability manifests starting from branch 6.6 and is fixed in versions 6.6.9 and 6.7. The status of the vulnerability fix in distributions can be assessed on the following pages: Debian, Ubuntu, SUSE, RHEL, Fedora, Arch Linux, Gentoo, Slackware. Among the distributions that provide packages with kernel 6.6, Arch Linux, Gentoo, Fedora, Slackware, OpenMandriva, and Manjaro can be noted; in other distributions, backporting of the change with the flaw into packages with older kernel branches is not ruled out (for example, Debian mentions that a package with kernel 6.5.13 is vulnerable, while the problematic change appeared in branch 6.6). As a workaround for protection, IPv6 can be disabled or the parameters 'net.ipv6.conf.*.accept_ra' can be set to 0.
Källa: opennet.ru
