Summary

A missing nullptr-check in handle_ra_input can cause a nullptr-deref.

Description

The reachable_time update in handle_ra_input is missing a nullptr-check for net_pkt_iface(pkt)->config.ip.ipv6 before calling net_if_ipv6_set_reachable_time:

if (reachable_time && reachable_time <= MAX_REACHABLE_TIME && (net_if_ipv6_get_reachable_time(net_pkt_iface(pkt)) != reachable_time)) {
    net_if_ipv6_set_base_reachable_time(net_pkt_iface(pkt), reachable_time);
    net_if_ipv6_set_reachable_time(net_pkt_iface(pkt)->config.ip.ipv6);
}

The ipv6 interface pointer is passed into net_if_ipv6_calc_reachable_time in net_if_ipv6_set_reachable_time:

ipv6->reachable_time = net_if_ipv6_calc_reachable_time(ipv6);

The ipv6 interface pointer is then used without an additional check in net_if_ipv6_calc_reachable_time:

min_reachable = (MIN_RANDOM_NUMER * ipv6->base_reachable_time) / MIN_RANDOM_DENOM;
max_reachable = (MAX_RANDOM_NUMER * ipv6->base_reachable_time) / MAX_RANDOM_DENOM;

However the other usages in handle_ra_input do check for a nullptr:

• net_if_ipv6_get_reachable_time:

  if (!iface->config.ip.ipv6) { return 0; }

  zephyr/include/zephyr/net/net_if.h

  Lines 1395 to 1413 in 98580f1

  	/**
  	* @brief Get IPv6 reachable timeout specified for a given interface
  	*
  	* @param iface Network interface
  	*
  	* @return Reachable timeout
  	*/
  	static inline uint32_t net_if_ipv6_get_reachable_time(struct net_if *iface)
  	{
  	#if defined(CONFIG_NET_NATIVE_IPV6)
  	if (!iface->config.ip.ipv6) {
  	return 0;
  	}
  	return iface->config.ip.ipv6->reachable_time;
  	#else
  	return 0;
  	#endif
  	}

• net_if_ipv6_set_base_reachable_time

  if (!iface->config.ip.ipv6) { return; }

  zephyr/include/zephyr/net/net_if.h

  Lines 1377 to 1393 in 98580f1

  	/**
  	* @brief Set IPv6 reachable time for a given interface
  	*
  	* @param iface Network interface
  	* @param reachable_time New reachable time
  	*/
  	static inline void net_if_ipv6_set_base_reachable_time(struct net_if *iface,
  	uint32_t reachable_time)
  	{
  	#if defined(CONFIG_NET_NATIVE_IPV6)
  	if (!iface->config.ip.ipv6) {
  	return;
  	}
  	iface->config.ip.ipv6->base_reachable_time = reachable_time;
  	#endif
  	}

Impact

• Potentially cause a Denial of Service.
  • Note: We are able to cause a DoS in Zephyr 2.2.0 with fuzzing, but did not try to reproduce in current versions.

Proposed Fix

• Add a nullptr check in net_if_ipv6_set_reachable_time or add a wrapper function with a check similar to net_if_ipv6_get_reachable_time or net_if_ipv6_set_base_reachable_time.