Vulnerability: The fib6_add_rt2node function in net/ipv6/ip6_fib.c in the IPv6 stack in the Linux kernel through 3.10.1 does not properly handle Router Advertisement (RA) messages in certain circumstances involving three routes that initially qualified for membership in an ECMP route set until a change occurred for one of the first two routes, which allows remote attackers to cause a denial of service (system crash) via a crafted sequence of messages.
Vulnerability ID: CVE-2013-4125
CWE: CWE-399
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2013-07-15
File: net/ipv6/ip6_fib.c
Commit message: ipv6: only static routes qualify for equal cost multipathing

Static routes in this case are non-expiring routes which did not get
configured by autoconf or by icmpv6 redirects.

To make sure we actually get an ecmp route while searching for the first
one in this fib6_node's leafs, also make sure it matches the ecmp route
assumptions.

v2:
a) Removed RTF_EXPIRE check in dst.from chain. The check of RTF_ADDRCONF
   already ensures that this route, even if added again without
   RTF_EXPIRES (in case of a RA announcement with infinite timeout),
   does not cause the rt6i_nsiblings logic to go wrong if a later RA
   updates the expiration time later.

v3:
a) Allow RTF_EXPIRES routes to enter the ecmp route set. We have to do so,
   because an pmtu event could update the RTF_EXPIRES flag and we would
   not count this route, if another route joins this set. We now filter
   only for RTF_GATEWAY|RTF_ADDRCONF|RTF_DYNAMIC, which are flags that
   don't get changed after rt6_info construction.

Cc: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Commit author: Hannes Frederic Sowa

Vulnerable version (before fix):
 static struct fib6_node * fib6_add_1(struct fib6_node *root, void *addr, 	return ln; }  /*  *	Insert routing information in a node.  */ static int fib6_add_rt2node(struct fib6_node *fn, struct rt6_info *rt, 	int add = (!info->nlh || 		   (info->nlh->nlmsg_flags & NLM_F_CREATE)); 	int found = 0;  	ins = &fn->leaf;  static int fib6_add_rt2node(struct fib6_node *fn, struct rt6_info *rt, 			 * To avoid long list, we only had siblings if the 			 * route have a gateway. 			 */ 			if (rt->rt6i_flags & RTF_GATEWAY && 			    !(rt->rt6i_flags & RTF_EXPIRES) && 			    !(iter->rt6i_flags & RTF_EXPIRES)) 				rt->rt6i_nsiblings++; 		}  static int fib6_add_rt2node(struct fib6_node *fn, struct rt6_info *rt, 		/* Find the first route that have the same metric */ 		sibling = fn->leaf; 		while (sibling) { 			if (sibling->rt6i_metric == rt->rt6i_metric) { 				list_add_tail(&rt->rt6i_siblings, 					      &sibling->rt6i_siblings); 				break;

Fixed version (after fix):
 static struct fib6_node * fib6_add_1(struct fib6_node *root, void *addr, 	return ln; }  static inline bool rt6_qualify_for_ecmp(struct rt6_info *rt) { 	return (rt->rt6i_flags & (RTF_GATEWAY|RTF_ADDRCONF|RTF_DYNAMIC)) == 	       RTF_GATEWAY; }  /*  *	Insert routing information in a node.  */ static int fib6_add_rt2node(struct fib6_node *fn, struct rt6_info *rt, 	int add = (!info->nlh || 		   (info->nlh->nlmsg_flags & NLM_F_CREATE)); 	int found = 0; 	bool rt_can_ecmp = rt6_qualify_for_ecmp(rt);  	ins = &fn->leaf;  static int fib6_add_rt2node(struct fib6_node *fn, struct rt6_info *rt, 			 * To avoid long list, we only had siblings if the 			 * route have a gateway. 			 */ 			if (rt_can_ecmp && 			    rt6_qualify_for_ecmp(iter)) 				rt->rt6i_nsiblings++; 		}  static int fib6_add_rt2node(struct fib6_node *fn, struct rt6_info *rt, 		/* Find the first route that have the same metric */ 		sibling = fn->leaf; 		while (sibling) { 			if (sibling->rt6i_metric == rt->rt6i_metric && 			    rt6_qualify_for_ecmp(sibling)) { 				list_add_tail(&rt->rt6i_siblings, 					      &sibling->rt6i_siblings); 				break;

Patch:
patch: @@ -632,6 +632,12 @@ static struct fib6_node * fib6_add_1(struct fib6_node *root, void *addr,
 	return ln;
 }
 
+static inline bool rt6_qualify_for_ecmp(struct rt6_info *rt)
+{
+	return (rt->rt6i_flags & (RTF_GATEWAY|RTF_ADDRCONF|RTF_DYNAMIC)) ==
+	       RTF_GATEWAY;
+}
+
 /*
  *	Insert routing information in a node.
  */
@@ -646,6 +652,7 @@ static int fib6_add_rt2node(struct fib6_node *fn, struct rt6_info *rt,
 	int add = (!info->nlh ||
 		   (info->nlh->nlmsg_flags & NLM_F_CREATE));
 	int found = 0;
+	bool rt_can_ecmp = rt6_qualify_for_ecmp(rt);
 
 	ins = &fn->leaf;
 
@@ -691,9 +698,8 @@ static int fib6_add_rt2node(struct fib6_node *fn, struct rt6_info *rt,
 			 * To avoid long list, we only had siblings if the
 			 * route have a gateway.
 			 */
-			if (rt->rt6i_flags & RTF_GATEWAY &&
-			    !(rt->rt6i_flags & RTF_EXPIRES) &&
-			    !(iter->rt6i_flags & RTF_EXPIRES))
+			if (rt_can_ecmp &&
+			    rt6_qualify_for_ecmp(iter))
 				rt->rt6i_nsiblings++;
 		}
 
@@ -715,7 +721,8 @@ static int fib6_add_rt2node(struct fib6_node *fn, struct rt6_info *rt,
 		/* Find the first route that have the same metric */
 		sibling = fn->leaf;
 		while (sibling) {
-			if (sibling->rt6i_metric == rt->rt6i_metric) {
+			if (sibling->rt6i_metric == rt->rt6i_metric &&
+			    rt6_qualify_for_ecmp(sibling)) {
 				list_add_tail(&rt->rt6i_siblings,
 					      &sibling->rt6i_siblings);
 				break;
path: net/ipv6/ip6_fib.c