Hello. We are Ubisectech Sirius Team, the vulnerability lab of China ValiantSec. Recently, our team has discovered a issue in Linux kernel 6.7. Attached to the email were a PoC file of the issue.
Stack dump: general protection fault, probably for non-canonical address 0xff1f1b1f1f1f1f24: 0000 [#1] PREEMPT SMP KASAN NOPTI KASAN: maybe wild-memory-access in range [0xf8f8f8f8f8f8f920-0xf8f8f8f8f8f8f927] CPU: 1 PID: 9367 Comm: kworker/1:5 Not tainted 6.7.0 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 Workqueue: ipv6_addrconf addrconf_dad_work RIP: 0010:__fib6_update_sernum_upto_root+0xa7/0x270 net/ipv6/ip6_fib.c:1358 Code: c1 e8 03 42 80 3c 20 00 0f 85 9b 01 00 00 48 8b 1b 48 85 db 0f 84 d9 00 00 00 e8 74 70 39 f8 48 8d 7b 2c 48 89 f8 48 c1 e8 03 <42> 0f b6 14 20 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 RSP: 0018:ffffc9000631f7c8 EFLAGS: 00010a07 RAX: 1f1f1f1f1f1f1f24 RBX: f8f8f8f8f8f8f8f8 RCX: ffffffff89508644 RDX: ffff888051d78000 RSI: ffffffff895085dc RDI: f8f8f8f8f8f8f924 RBP: 0000000000000001 R08: 0000000000000005 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000000 R12: dffffc0000000000 R13: 0000000000000186 R14: ffff888052396c00 R15: ffffed100a472d80 FS: 0000000000000000(0000) GS:ffff88807ec00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f42c8487d00 CR3: 000000004b42c000 CR4: 0000000000750ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: <TASK> __list_add include/linux/list.h:153 [inline] list_add include/linux/list.h:169 [inline] fib6_add+0x16c4/0x4410 net/ipv6/ip6_fib.c:1490 __ip6_ins_rt net/ipv6/route.c:1313 [inline] ip6_ins_rt+0xb6/0x110 net/ipv6/route.c:1323 __ipv6_ifa_notify+0xab3/0xd30 net/ipv6/addrconf.c:6266 ipv6_ifa_notify net/ipv6/addrconf.c:6303 [inline] addrconf_dad_completed+0x15f/0xef0 net/ipv6/addrconf.c:4317 addrconf_dad_work+0x785/0x14e0 net/ipv6/addrconf.c:4260 process_one_work+0x87b/0x15c0 kernel/workqueue.c:3226 worker_thread+0x855/0x1200 kernel/workqueue.c:3380 kthread+0x2cc/0x3b0 kernel/kthread.c:388 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1b/0x30 arch/x86/entry/entry_64.S:256 </TASK> Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:__fib6_update_sernum_upto_root+0xa7/0x270 net/ipv6/ip6_fib.c:1358 Code: c1 e8 03 42 80 3c 20 00 0f 85 9b 01 00 00 48 8b 1b 48 85 db 0f 84 d9 00 00 00 e8 74 70 39 f8 48 8d 7b 2c 48 89 f8 48 c1 e8 03 <42> 0f b6 14 20 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 RSP: 0018:ffffc9000631f7c8 EFLAGS: 00010a07 RAX: 1f1f1f1f1f1f1f24 RBX: f8f8f8f8f8f8f8f8 RCX: ffffffff89508644 RDX: ffff888051d78000 RSI: ffffffff895085dc RDI: f8f8f8f8f8f8f924 RBP: 0000000000000001 R08: 0000000000000005 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000000 R12: dffffc0000000000 R13: 0000000000000186 R14: ffff888052396c00 R15: ffffed100a472d80 FS: 0000000000000000(0000) GS:ffff88807ec00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f42c8487d00 CR3: 000000004b42c000 CR4: 0000000000750ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 ---------------- Code disassembly (best guess): 0: c1 e8 03 shr $0x3,%eax 3: 42 80 3c 20 00 cmpb $0x0,(%rax,%r12,1) 8: 0f 85 9b 01 00 00 jne 0x1a9 e: 48 8b 1b mov (%rbx),%rbx 11: 48 85 db test %rbx,%rbx 14: 0f 84 d9 00 00 00 je 0xf3 1a: e8 74 70 39 f8 call 0xf8397093 1f: 48 8d 7b 2c lea 0x2c(%rbx),%rdi 23: 48 89 f8 mov %rdi,%rax 26: 48 c1 e8 03 shr $0x3,%rax * 2a: 42 0f b6 14 20 movzbl (%rax,%r12,1),%edx <-- trapping instruction 2f: 48 89 f8 mov %rdi,%rax 32: 83 e0 07 and $0x7,%eax 35: 83 c0 03 add $0x3,%eax 38: 38 d0 cmp %dl,%al 3a: 7c 08 jl 0x44 3c: 84 d2 test %dl,%dl 3e: 0f .byte 0xf 3f: 85 .byte 0x85 Thank you for taking the time to read this email and we look forward to working with you further.
poc.c
Description: Binary data
