Linux Kernel Unresolved Entries Wild Memory Access Vulnerability Leading to Denial-of-Service

A vulnerability in the Linux kernel's IP multicast routing (ipmr) implementation can lead to a denial-of-service condition. The issue arises when the function 'mr_mfc_uses_dev()' is called for unresolved entries, which can cause a kernel crash. This happens because the function attempts to access data that is not properly initialized, leading to a wild memory access. The vulnerability has been present in the kernel version 6.13.0-rc7.

Impact

Exploitation of this vulnerability causes a kernel crash, leading to a denial-of-service condition.

Reproduction

The vulnerability can be reproduced by invoking the 'mr_mfc_uses_dev()' function with unresolved multicast forwarding cache entries. This can be done through netlink messages that trigger the 'ipmr_rtm_dumproute' function, which processes routing table dumps and can inadvertently access unresolved entries, causing a crash.