HIGH
ipv4 IGMP Timer UAF
CVE-2023-6932
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI7.8HIGH
01Description
A use-after-free vulnerability in the Linux kernel's ipv4: igmp component can be exploited to achieve local privilege escalation. A race condition can be exploited to cause a timer be mistakenly registered on a RCU read locked object which is freed by another thread. We recommend upgrading past commit e2b706c691905fe78468c361aaabc719d0a496f1.
02KernelScan AI Analysis
Risk summary
An attacker who can send IGMP query packets to a vulnerable system and has local access to configure network interfaces could potentially trigger this use-after-free condition. While the vulnerability requires specific network configuration (bridge with multicast addresses) and timing conditions, successful exploitation could lead to kernel memory corruption and privilege escalation.
Vulnerability analysis
Summary: A race condition in the IPv4 IGMP (Internet Group Management Protocol) implementation allows a timer to be registered on a multicast list object that has already been freed by another thread, leading to a use-after-free vulnerability.
Root Cause: The original code in igmp_start_timer() used mod_timer() followed by refcount_inc() without proper synchronization. This created a race window where Thread A could decrement the reference count to zero and free the multicast list object while Thread B was attempting to start a timer on the same object. The refcount_inc() would then operate on freed memory.
Attack Surface: This vulnerability can be triggered by network packets (IGMPv2 query messages) sent to a system with bridge interfaces configured with multicast addresses. The race condition is more likely to occur when bridge interfaces are rapidly brought up and down while receiving IGMP traffic. Local access is required to configure the network interfaces, but the triggering packets can come from the network.
Fix Mechanism: The patch replaces the unsafe sequence with refcount_inc_not_zero() which atomically checks if the reference count is non-zero before incrementing it. If the increment succeeds, it then calls mod_timer(), and if mod_timer() indicates the timer was already pending, it decrements the reference count with ip_ma_put(). This ensures the object cannot be freed while the timer is being set up.
03Fix Versions
| Branch | Fixed in | Patch commit |
|---|---|---|
| mainline | 6.7 | e2b706c69190 |