[Bug] "general protection fault in corrupted at " in Linux kernel v6.14 [sock_kmalloc() Null Pointer Dereference via CALIPSO NetLabel Processing in IPv6 SYN Request (IPv6 + SELinux + CALIPSO Path)]

[Bug] "general protection fault in corrupted at " in Linux kernel v6.14 [sock_kmalloc() Null Pointer Dereference via CALIPSO NetLabel Processing in IPv6 SYN Request (IPv6 + SELinux + CALIPSO Path)]

[John]

Dear Linux Kernel Maintainers,

I hope this message finds you well.

I am writing to report a potential vulnerability I encountered during
testing of the Linux Kernel version v6.14.

Git Commit: 38fec10eb60d687e30c8c6b5420d86e8149f7557 (tag: v6.14)

Bug Location: 0010:sock_kmalloc+0x35/0x170 net/core/sock.c:2806

Bug report: https://hastebin.com/share/vewamacadi.bash

Complete log: https://hastebin.com/share/otoxiberok.perl

Entire kernel config: https://pastebin.com/MRWGr3nv

Root Cause Analysis:
A NULL pointer dereference occurs in sock_kmalloc() at
net/core/sock.c:2806 due to a missing check for the validity of the sk
pointer.
The function attempts to retrieve the associated network namespace
using sock_net(sk), which internally accesses sk->__sk_common.skc_net
via read_pnet().
However, in the specific code path triggered by an incoming IPv6 TCP
SYN packet with NetLabel/CALIPSO security attributes, the sk structure
is either NULL or uninitialized, resulting in a general protection
fault.
The vulnerability is triggered via the SELinux NetLabel connection
request hook and affects systems with IPv6 + SELinux + CALIPSO
enabled.

At present, I have not yet obtained a minimal reproducer for this
issue. However, I am actively working on reproducing it, and I will
promptly share any additional findings or a working reproducer as soon
as it becomes available.

Thank you very much for your time and attention to this matter. I
truly appreciate the efforts of the Linux kernel community.

Best regards,
John

Re: [Bug] "general protection fault in corrupted at " in Linux kernel v6.14 [sock_kmalloc() Null Pointer Dereference via CALIPSO NetLabel Processing in IPv6 SYN Request (IPv6 + SELinux + CALIPSO Path)]

[Kuniyuki Iwashima]

From: John <john.cs.hey@gmail.com>
Date: Thu, 22 May 2025 23:41:23 +0800
> Dear Linux Kernel Maintainers,
> 
> I hope this message finds you well.
> 
> I am writing to report a potential vulnerability I encountered during
> testing of the Linux Kernel version v6.14.
> 
> Git Commit: 38fec10eb60d687e30c8c6b5420d86e8149f7557 (tag: v6.14)
> 
> Bug Location: 0010:sock_kmalloc+0x35/0x170 net/core/sock.c:2806
> 
> Bug report: https://hastebin.com/share/vewamacadi.bash
> 
> Complete log: https://hastebin.com/share/otoxiberok.perl
> 
> Entire kernel config: https://pastebin.com/MRWGr3nv

Thanks for the report.


> 
> Root Cause Analysis:
> A NULL pointer dereference occurs in sock_kmalloc() at
> net/core/sock.c:2806 due to a missing check for the validity of the sk
> pointer.
> The function attempts to retrieve the associated network namespace
> using sock_net(sk), which internally accesses sk->__sk_common.skc_net
> via read_pnet().
> However, in the specific code path triggered by an incoming IPv6 TCP
> SYN packet with NetLabel/CALIPSO security attributes, the sk structure
> is either NULL or uninitialized, resulting in a general protection
> fault.

calipso_req_{set,del}attr() fetches sk by sk_to_full_sk(req_to_sk(req)),
but req->rsk_listener could be NULL in the SYN cookie case.

Here we need to return 0 or an error to avoid the null-ptr-deref.
0 should be avoided as it bypasses LSM, but returning an error
means CALIPSO effectively disables SYN Cookie, but it will be ok
given no user has reported the null-ptr-deref for a decade.

---8<---
diff --git a/net/ipv6/calipso.c b/net/ipv6/calipso.c
index 62618a058b8f..86c26316592b 100644
--- a/net/ipv6/calipso.c
+++ b/net/ipv6/calipso.c
@@ -1207,6 +1207,9 @@ static int calipso_req_setattr(struct request_sock *req,
 	struct ipv6_opt_hdr *old, *new;
 	struct sock *sk = sk_to_full_sk(req_to_sk(req));
 
+	if (!sk)
+		return -ENOENT;
+
 	if (req_inet->ipv6_opt && req_inet->ipv6_opt->hopopt)
 		old = req_inet->ipv6_opt->hopopt;
 	else
@@ -1247,6 +1250,9 @@ static void calipso_req_delattr(struct request_sock *req)
 	struct ipv6_txoptions *txopts;
 	struct sock *sk = sk_to_full_sk(req_to_sk(req));
 
+	if (!sk)
+		return -ENOENT;
+
 	if (!req_inet->ipv6_opt || !req_inet->ipv6_opt->hopopt)
 		return;
 
---8<---



> The vulnerability is triggered via the SELinux NetLabel connection
> request hook and affects systems with IPv6 + SELinux + CALIPSO
> enabled.