CVE-2021-47291

In the Linux kernel, the following vulnerability has been resolved:

ipv6: fix another slab-out-of-bounds in fib6_nh_flush_exceptions

While running the self-tests on a KASAN enabled kernel, I observed a slab-out-of-bounds splat very similar to the one reported in commit 821bbf79fe46 ("ipv6: Fix KASAN: slab-out-of-bounds Read in fib6_nh_flush_exceptions").

We additionally need to take care of fib6_metrics initialization failure when the caller provides an nh.

The fix is similar, explicitly free the route instead of calling fib6_info_release on a half-initialized object.

A low severity out-of-bounds read flaw was found in the Linux kernel's IPv6 routing subsystem (net/ipv6/route.c). When an IPv6 route is created with a caller-provided nexthop and the initialization of fib6_metrics fails, the error-handling path in fib6_nh_flush_exceptions calls fib6_info_release on a half-initialized fib6_info object, causing a slab-out-of-bounds read, as observed with KASAN-enabled kernels during self-tests. Triggering this issue requires local privileged access, namely the ability to configure IPv6 routes combined with a fib6_metrics initialization failure, and the realistic consequence is a kernel crash and resulting denial of service. Red Hat therefore rates this flaw LOW impact with CVSS 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), reflecting availability impact only; the higher NIST (7.1) and CVE.org (7.8) scores additionally assume confidentiality and integrity impacts that Red Hat does not consider established for this out-of-bounds read.

The vulnerable code was introduced upstream in Linux v5.3 and is fixed in upstream kernel releases. Red Hat's current records show the supported Red Hat Enterprise Linux 8 update streams, the kernels used in Hosted OpenShift (ARO and OSD), and Fedora as not affected, while the RHEL 9 kernel and kernel-rt records were delegated to the kernel team, which resolved them as not affected. The Red Hat Enterprise Linux 7 and 6 Extended Life Cycle Support streams are out of support scope for this flaw.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.