Linux Kernel IPv6 Route Handling Infinite Loop Vulnerability

A vulnerability in the Linux kernel's IPv6 routing can lead to a potential infinite loop in the 'fib6_select_path' function. This issue arises from improper handling of the 'fib6_siblings' list, which can cause the routing logic to get stuck, especially under certain conditions of high next-hop churn. The problem was identified during an audit and is similar to a previously reported issue in the 'rt6_fill_node' function. The vulnerability affects the stable version of the Linux kernel.

Impact

Exploitation of this vulnerability can cause a soft lockup, where the system becomes unresponsive for a period, as the 'fib6_select_path' function gets stuck in an infinite loop, unable to complete its processing.

Reproduction

The vulnerability can be reproduced by invoking the 'fib6_select_path' function in a scenario with high next-hop churn, which causes the function to enter an infinite loop. This can be achieved by rapidly changing the next-hop routes while the function is processing, creating a situation where the loop never terminates.

Remediation

The vulnerability has been fixed in the Linux kernel. Users can upgrade to the latest version to address this issue.