cve/published/2024/CVE-2024-26635.mbox

From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: <linux-cve-announce@vger.kernel.org>
Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org>
Subject: CVE-2024-26635: llc: Drop support for ETH_P_TR_802_2.

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

llc: Drop support for ETH_P_TR_802_2.

syzbot reported an uninit-value bug below. [0]

llc supports ETH_P_802_2 (0x0004) and used to support ETH_P_TR_802_2
(0x0011), and syzbot abused the latter to trigger the bug.

  write$tun(r0, &(0x7f0000000040)={@val={0x0, 0x11}, @val, @mpls={[], @llc={@snap={0xaa, 0x1, ')', "90e5dd"}}}}, 0x16)

llc_conn_handler() initialises local variables {saddr,daddr}.mac
based on skb in llc_pdu_decode_sa()/llc_pdu_decode_da() and passes
them to __llc_lookup().

However, the initialisation is done only when skb->protocol is
htons(ETH_P_802_2), otherwise, __llc_lookup_established() and
__llc_lookup_listener() will read garbage.

The missing initialisation existed prior to commit 211ed865108e
("net: delete all instances of special processing for token ring").

It removed the part to kick out the token ring stuff but forgot to
close the door allowing ETH_P_TR_802_2 packets to sneak into llc_rcv().

Let's remove llc_tr_packet_type and complete the deprecation.

[0]:
BUG: KMSAN: uninit-value in __llc_lookup_established+0xe9d/0xf90
 __llc_lookup_established+0xe9d/0xf90
 __llc_lookup net/llc/llc_conn.c:611 [inline]
 llc_conn_handler+0x4bd/0x1360 net/llc/llc_conn.c:791
 llc_rcv+0xfbb/0x14a0 net/llc/llc_input.c:206
 __netif_receive_skb_one_core net/core/dev.c:5527 [inline]
 __netif_receive_skb+0x1a6/0x5a0 net/core/dev.c:5641
 netif_receive_skb_internal net/core/dev.c:5727 [inline]
 netif_receive_skb+0x58/0x660 net/core/dev.c:5786
 tun_rx_batched+0x3ee/0x980 drivers/net/tun.c:1555
 tun_get_user+0x53af/0x66d0 drivers/net/tun.c:2002
 tun_chr_write_iter+0x3af/0x5d0 drivers/net/tun.c:2048
 call_write_iter include/linux/fs.h:2020 [inline]
 new_sync_write fs/read_write.c:491 [inline]
 vfs_write+0x8ef/0x1490 fs/read_write.c:584
 ksys_write+0x20f/0x4c0 fs/read_write.c:637
 __do_sys_write fs/read_write.c:649 [inline]
 __se_sys_write fs/read_write.c:646 [inline]
 __x64_sys_write+0x93/0xd0 fs/read_write.c:646
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x44/0x110 arch/x86/entry/common.c:82
 entry_SYSCALL_64_after_hwframe+0x63/0x6b

Local variable daddr created at:
 llc_conn_handler+0x53/0x1360 net/llc/llc_conn.c:783
 llc_rcv+0xfbb/0x14a0 net/llc/llc_input.c:206

CPU: 1 PID: 5004 Comm: syz-executor994 Not tainted 6.6.0-syzkaller-14500-g1c41041124bd #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/09/2023

The Linux kernel CVE team has assigned CVE-2024-26635 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 3.5 with commit 211ed865108e24697b44bee5daac502ee6bdd4a4 and fixed in 4.19.307 with commit 165ad1e22779685c3ed3dd349c6c4c632309cc62
	Issue introduced in 3.5 with commit 211ed865108e24697b44bee5daac502ee6bdd4a4 and fixed in 5.4.269 with commit b8e8838f82f332ae80c643dbb1ca4418d0628097
	Issue introduced in 3.5 with commit 211ed865108e24697b44bee5daac502ee6bdd4a4 and fixed in 5.10.210 with commit 9ccdef19cf9497c2803b005369668feb91cacdfd
	Issue introduced in 3.5 with commit 211ed865108e24697b44bee5daac502ee6bdd4a4 and fixed in 5.15.149 with commit c0fe2fe7a5a291dfcf6dc64301732c8d3dc6a828
	Issue introduced in 3.5 with commit 211ed865108e24697b44bee5daac502ee6bdd4a4 and fixed in 6.1.76 with commit 660c3053d992b68fee893a0e9ec9159228cffdc6
	Issue introduced in 3.5 with commit 211ed865108e24697b44bee5daac502ee6bdd4a4 and fixed in 6.6.15 with commit f1f34a515fb1e25e85dee94f781e7869ae351fb8
	Issue introduced in 3.5 with commit 211ed865108e24697b44bee5daac502ee6bdd4a4 and fixed in 6.7.3 with commit df57fc2f2abf548aa889a36ab0bdcc94a75399dc
	Issue introduced in 3.5 with commit 211ed865108e24697b44bee5daac502ee6bdd4a4 and fixed in 6.8 with commit e3f9bed9bee261e3347131764e42aeedf1ffea61

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2024-26635
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	include/net/llc_pdu.h
	net/llc/llc_core.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/165ad1e22779685c3ed3dd349c6c4c632309cc62
	https://git.kernel.org/stable/c/b8e8838f82f332ae80c643dbb1ca4418d0628097
	https://git.kernel.org/stable/c/9ccdef19cf9497c2803b005369668feb91cacdfd
	https://git.kernel.org/stable/c/c0fe2fe7a5a291dfcf6dc64301732c8d3dc6a828
	https://git.kernel.org/stable/c/660c3053d992b68fee893a0e9ec9159228cffdc6
	https://git.kernel.org/stable/c/f1f34a515fb1e25e85dee94f781e7869ae351fb8
	https://git.kernel.org/stable/c/df57fc2f2abf548aa889a36ab0bdcc94a75399dc
	https://git.kernel.org/stable/c/e3f9bed9bee261e3347131764e42aeedf1ffea61