Bug 2196292 (CVE-2023-2156, ZDI-23-547, ZDI-CAN-16223)

Summary: CVE-2023-2156 kernel: net: IPv6 RPL protocol reachable assertion leads to DoS
Product: [Other] Security Response Reporter: Mauro Matteo Cascella <mcascell>
Component: vulnerabilityAssignee: Nobody <nobody>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: aahringo, acaringi, allarkin, bhu, chwhite, crwood, dbohanno, ddepaula, debarbos, dfreiber, dvlasenk, ezulian, hkrzesin, jarod, jburrell, jdenham, jfaracco, jferlan, jforbes, jlelli, joe.lawrence, jpoimboe, jshortt, jstancek, jwyatt, kcarcia, kernel-mgr, kpatch-maint-bot, ldoskova, lgoncalv, lzampier, nmurray, ptalbert, qzhao, rhandlin, rogbas, rrobaina, rvrbovsk, rysulliv, scweaver, sdubroca, tyberry, vkumar, walters, wcosta, williams, wmealing, ycote
Target Milestone: ---Keywords: Reopened, Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: kernel 6.2.13 Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in the Linux kernel's networking subsystem within the RPL protocol's handling. This issue results from the improper handling of user-supplied data, which can lead to an assertion failure. This flaw allows an unauthenticated, remote attacker to create a denial of service condition on the system.
 Story Points: ---
Clone Of: Environment:
Last Closed: 2023-11-16 13:08:46 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2196480, 2196495, 2196496, 2196497, 2196498, 2196499, 2196500, 2196501, 2196586    
Bug Blocks: 2186277    

Description Mauro Matteo Cascella 2023-05-08 16:02:47 UTC 
A reachable assertion issue was found in the Linux kernel's IPv6 RPL protocol. Quoting ZDI security advisory [1]:

"This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Linux Kernel. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the handling of the RPL protocol. The issue results from the lack of proper handling of user-supplied data, which can result in an assertion failure. An attacker can leverage this vulnerability to create a denial-of-service condition on the system."

[1] https://www.zerodayinitiative.com/advisories/ZDI-23-547/
Comment 1 Mauro Matteo Cascella 2023-05-08 19:52:45 UTC 
Tentative patch:
https://lore.kernel.org/netdev/20230417130052.2316819-1-aahringo@redhat.com/
https://github.com/torvalds/linux/commit/4e006c7a6dac0ead4c1bf606000aa90a372fc253

As mentioned in the ZDI advisory "the patch may not work, and it was confirmed by the ZDI that the vulnerability is reproducible on the latest mainline".
Comment 2 Mauro Matteo Cascella 2023-05-09 10:13:53 UTC 
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 2196480]
Comment 15 Justin M. Forbes 2023-06-05 12:38:51 UTC 
This was fixed for Fedora with the 6.2.13 stable kernel updates.
Comment 17 susanjkeel 2023-11-16 07:15:32 UTC Comment hidden (spam)