CVE-2023-0394: Null Pointer Dereference

A null pointer dereference in Linux kernel that affects multiple kernel versions.

The bug is in "rawv6pushpendingframes" function in net/ipv6/raw.c. According to Herbert Xu, who fixed the bug, the root cause is that "totallen = inetsk(sk)->cork.base.length" in this function also counts the length of the extension header (+ the amount of valid data in the socket cork queue). In the vulnerable version of the function, it directly uses the length as the amount of data in the cork queue. In the following code:

struct skbuff csumskb = NULL; ... skbqueuewalk(&sk->skwritequeue, skb) { ... if (offset >= len) { offset -= len; continue; } csumskb = skb; } skb = csumskb;

If the offset is larger than the amount of data in the socket cork queue but smaller than valid data length + extension header length, then the loop shown above will always enter the "if (offset >= len)" branch. As a result, csumskb will never be set. Consequently, the final skb variable will be set to NULL.

Null dereference happens in the following "skbtransportoffset(skb);" call.

— Red Hat