cve/published/2023/CVE-2023-52698.mbox

From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: <linux-cve-announce@vger.kernel.org>
Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org>
Subject: CVE-2023-52698: calipso: fix memory leak in netlbl_calipso_add_pass()

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

calipso: fix memory leak in netlbl_calipso_add_pass()

If IPv6 support is disabled at boot (ipv6.disable=1),
the calipso_init() -> netlbl_calipso_ops_register() function isn't called,
and the netlbl_calipso_ops_get() function always returns NULL.
In this case, the netlbl_calipso_add_pass() function allocates memory
for the doi_def variable but doesn't free it with the calipso_doi_free().

BUG: memory leak
unreferenced object 0xffff888011d68180 (size 64):
  comm "syz-executor.1", pid 10746, jiffies 4295410986 (age 17.928s)
  hex dump (first 32 bytes):
    00 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<...>] kmalloc include/linux/slab.h:552 [inline]
    [<...>] netlbl_calipso_add_pass net/netlabel/netlabel_calipso.c:76 [inline]
    [<...>] netlbl_calipso_add+0x22e/0x4f0 net/netlabel/netlabel_calipso.c:111
    [<...>] genl_family_rcv_msg_doit+0x22f/0x330 net/netlink/genetlink.c:739
    [<...>] genl_family_rcv_msg net/netlink/genetlink.c:783 [inline]
    [<...>] genl_rcv_msg+0x341/0x5a0 net/netlink/genetlink.c:800
    [<...>] netlink_rcv_skb+0x14d/0x440 net/netlink/af_netlink.c:2515
    [<...>] genl_rcv+0x29/0x40 net/netlink/genetlink.c:811
    [<...>] netlink_unicast_kernel net/netlink/af_netlink.c:1313 [inline]
    [<...>] netlink_unicast+0x54b/0x800 net/netlink/af_netlink.c:1339
    [<...>] netlink_sendmsg+0x90a/0xdf0 net/netlink/af_netlink.c:1934
    [<...>] sock_sendmsg_nosec net/socket.c:651 [inline]
    [<...>] sock_sendmsg+0x157/0x190 net/socket.c:671
    [<...>] ____sys_sendmsg+0x712/0x870 net/socket.c:2342
    [<...>] ___sys_sendmsg+0xf8/0x170 net/socket.c:2396
    [<...>] __sys_sendmsg+0xea/0x1b0 net/socket.c:2429
    [<...>] do_syscall_64+0x30/0x40 arch/x86/entry/common.c:46
    [<...>] entry_SYSCALL_64_after_hwframe+0x61/0xc6

Found by InfoTeCS on behalf of Linux Verification Center
(linuxtesting.org) with Syzkaller

[PM: merged via the LSM tree at Jakub Kicinski request]

The Linux kernel CVE team has assigned CVE-2023-52698 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 4.8 with commit cb72d38211eacda2dd90b09540542b6582da614e and fixed in 4.19.306 with commit 9a8f811a146aa2a0230f8edb2e9f4b6609aab8da
	Issue introduced in 4.8 with commit cb72d38211eacda2dd90b09540542b6582da614e and fixed in 5.4.268 with commit 36e19f84634aaa94f543fedc0a07588949638d53
	Issue introduced in 4.8 with commit cb72d38211eacda2dd90b09540542b6582da614e and fixed in 5.10.209 with commit 44a88650ba55e6a7f2ec485d2c2413ba7e216f01
	Issue introduced in 4.8 with commit cb72d38211eacda2dd90b09540542b6582da614e and fixed in 5.15.148 with commit a4529a08d3704c17ea9c7277d180e46b99250ded
	Issue introduced in 4.8 with commit cb72d38211eacda2dd90b09540542b6582da614e and fixed in 6.1.75 with commit 321b3a5592c8a9d6b654c7c64833ea67dbb33149
	Issue introduced in 4.8 with commit cb72d38211eacda2dd90b09540542b6582da614e and fixed in 6.6.14 with commit 408bbd1e1746fe33e51f4c81c2febd7d3841d031
	Issue introduced in 4.8 with commit cb72d38211eacda2dd90b09540542b6582da614e and fixed in 6.7.2 with commit f14d36e6e97fe935a20e0ceb159c100f90b6627c
	Issue introduced in 4.8 with commit cb72d38211eacda2dd90b09540542b6582da614e and fixed in 6.8 with commit ec4e9d630a64df500641892f4e259e8149594a99

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2023-52698
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/netlabel/netlabel_calipso.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/9a8f811a146aa2a0230f8edb2e9f4b6609aab8da
	https://git.kernel.org/stable/c/36e19f84634aaa94f543fedc0a07588949638d53
	https://git.kernel.org/stable/c/44a88650ba55e6a7f2ec485d2c2413ba7e216f01
	https://git.kernel.org/stable/c/a4529a08d3704c17ea9c7277d180e46b99250ded
	https://git.kernel.org/stable/c/321b3a5592c8a9d6b654c7c64833ea67dbb33149
	https://git.kernel.org/stable/c/408bbd1e1746fe33e51f4c81c2febd7d3841d031
	https://git.kernel.org/stable/c/f14d36e6e97fe935a20e0ceb159c100f90b6627c
	https://git.kernel.org/stable/c/ec4e9d630a64df500641892f4e259e8149594a99