REDHAT-BUG-2520980: Use After Free
A use-after-free vulnerability was found in the Linux kernel's IPv6 FIB rule lookup path. In fib6rulesuppress(), when a route is suppressed and released via ip6rtputflags(), the res->rt6 pointer is not cleared. If no later rule supplies a replacement route, fib6rulelookup() returns the stale (freed) rt6info to its caller. The subsequent dstrelease() then operates on freed memory, hitting rcurefputslowpath(). A local attacker who can configure IPv6 routing/FIB rules could trigger this to cause a denial of service (kernel crash) or potentially escalate privileges.
Affected Software
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Systems are exposed when a local attacker can configure IPv6 routing or FIB rules. The described impact is a kernel crash, with potential for local privilege escalation.
What does an attacker need to do to trigger the flaw?
The attacker needs local access and the ability to configure IPv6 routing/FIB rules. They must create a rule-lookup condition where a route is suppressed and no later rule replaces the released route.
How can I tell whether a system may already be affected?
A triggered system may crash when dst_release() operates on freed memory, with rcuref_put_slowpath() identified in the failure path. The provided information does not identify affected kernel versions or a configuration-only detection method.