CVE-2023-3022: 
Linux Kernel vulnerability analysis and mitigation

A vulnerability was discovered in the IPv6 module of the Linux kernel (CVE-2023-3022). The issue stems from inconsistent usage of arg.result in fib6rulelookup, where it sometimes holds rt6info and other times fib6info. This inconsistency was not properly handled in code sections where rt6info was expected unconditionally, potentially leading to a kernel panic in fib6rule_suppress. The vulnerability was discovered and disclosed in June 2023 and affects Linux kernel versions up to 5.1 (NVD).

The vulnerability occurs in the IPv6 module's routing functionality, specifically in the fib6rulelookup function. The technical issue involves the inconsistent handling of arg.result, which alternates between holding rt6info and fib6info data structures. This inconsistency becomes problematic when other parts of the code unconditionally expect rt6info, leading to potential kernel panics in the fib6rule_suppress function. The vulnerability has been assigned a CVSS v3.1 base score of 5.5 (Medium), with a vector of CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (NVD).

When exploited, this vulnerability can cause a kernel panic with the message "fib6rulesuppress+0x22" when receiving specific network packets to a local IPv6 address that matches certain routing rules. This effectively results in a denial of service condition for affected systems (Red Hat Bugzilla).

The vulnerability was fixed in Linux kernel version 5.2-rc1. The fix involves adding rt6info to fib6result and making the use of arg.result consistent throughout IPv6 rules. Red Hat has released updates for affected versions through various errata, including RHSA-2023:1130 for Red Hat Enterprise Linux 8.6 Extended Update Support and RHSA-2022:1975 for kernel-rt in Red Hat Enterprise Linux 8 (Red Hat Bugzilla).