cve/published/2024/CVE-2024-26805.mbox - pub/scm/linux/security/vulns - Git at Google

 From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001
 From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 To: <linux-cve-announce@vger.kernel.org>
 Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org>
 Subject: CVE-2024-26805: netlink: Fix kernel-infoleak-after-free in __skb_datagram_iter

 Description
 ===========

 In the Linux kernel, the following vulnerability has been resolved:

 netlink: Fix kernel-infoleak-after-free in __skb_datagram_iter

 syzbot reported the following uninit-value access issue [1]:

 netlink_to_full_skb() creates a new `skb` and puts the `skb->data`
 passed as a 1st arg of netlink_to_full_skb() onto new `skb`. The data
 size is specified as `len` and passed to skb_put_data(). This `len`
 is based on `skb->end` that is not data offset but buffer offset. The
 `skb->end` contains data and tailroom. Since the tailroom is not
 initialized when the new `skb` created, KMSAN detects uninitialized
 memory area when copying the data.

 This patch resolved this issue by correct the len from `skb->end` to
 `skb->len`, which is the actual data offset.

 BUG: KMSAN: kernel-infoleak-after-free in instrument_copy_to_user include/linux/instrumented.h:114 [inline]
 BUG: KMSAN: kernel-infoleak-after-free in copy_to_user_iter lib/iov_iter.c:24 [inline]
 BUG: KMSAN: kernel-infoleak-after-free in iterate_ubuf include/linux/iov_iter.h:29 [inline]
 BUG: KMSAN: kernel-infoleak-after-free in iterate_and_advance2 include/linux/iov_iter.h:245 [inline]
 BUG: KMSAN: kernel-infoleak-after-free in iterate_and_advance include/linux/iov_iter.h:271 [inline]
 BUG: KMSAN: kernel-infoleak-after-free in _copy_to_iter+0x364/0x2520 lib/iov_iter.c:186
  instrument_copy_to_user include/linux/instrumented.h:114 [inline]
  copy_to_user_iter lib/iov_iter.c:24 [inline]
  iterate_ubuf include/linux/iov_iter.h:29 [inline]
  iterate_and_advance2 include/linux/iov_iter.h:245 [inline]
  iterate_and_advance include/linux/iov_iter.h:271 [inline]
  _copy_to_iter+0x364/0x2520 lib/iov_iter.c:186
  copy_to_iter include/linux/uio.h:197 [inline]
  simple_copy_to_iter+0x68/0xa0 net/core/datagram.c:532
  __skb_datagram_iter+0x123/0xdc0 net/core/datagram.c:420
  skb_copy_datagram_iter+0x5c/0x200 net/core/datagram.c:546
  skb_copy_datagram_msg include/linux/skbuff.h:3960 [inline]
  packet_recvmsg+0xd9c/0x2000 net/packet/af_packet.c:3482
  sock_recvmsg_nosec net/socket.c:1044 [inline]
  sock_recvmsg net/socket.c:1066 [inline]
  sock_read_iter+0x467/0x580 net/socket.c:1136
  call_read_iter include/linux/fs.h:2014 [inline]
  new_sync_read fs/read_write.c:389 [inline]
  vfs_read+0x8f6/0xe00 fs/read_write.c:470
  ksys_read+0x20f/0x4c0 fs/read_write.c:613
  __do_sys_read fs/read_write.c:623 [inline]
  __se_sys_read fs/read_write.c:621 [inline]
  __x64_sys_read+0x93/0xd0 fs/read_write.c:621
  do_syscall_x64 arch/x86/entry/common.c:52 [inline]
  do_syscall_64+0x44/0x110 arch/x86/entry/common.c:83
  entry_SYSCALL_64_after_hwframe+0x63/0x6b

 Uninit was stored to memory at:
  skb_put_data include/linux/skbuff.h:2622 [inline]
  netlink_to_full_skb net/netlink/af_netlink.c:181 [inline]
  __netlink_deliver_tap_skb net/netlink/af_netlink.c:298 [inline]
  __netlink_deliver_tap+0x5be/0xc90 net/netlink/af_netlink.c:325
  netlink_deliver_tap net/netlink/af_netlink.c:338 [inline]
  netlink_deliver_tap_kernel net/netlink/af_netlink.c:347 [inline]
  netlink_unicast_kernel net/netlink/af_netlink.c:1341 [inline]
  netlink_unicast+0x10f1/0x1250 net/netlink/af_netlink.c:1368
  netlink_sendmsg+0x1238/0x13d0 net/netlink/af_netlink.c:1910
  sock_sendmsg_nosec net/socket.c:730 [inline]
  __sock_sendmsg net/socket.c:745 [inline]
  ____sys_sendmsg+0x9c2/0xd60 net/socket.c:2584
  ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2638
  __sys_sendmsg net/socket.c:2667 [inline]
  __do_sys_sendmsg net/socket.c:2676 [inline]
  __se_sys_sendmsg net/socket.c:2674 [inline]
  __x64_sys_sendmsg+0x307/0x490 net/socket.c:2674
  do_syscall_x64 arch/x86/entry/common.c:52 [inline]
  do_syscall_64+0x44/0x110 arch/x86/entry/common.c:83
  entry_SYSCALL_64_after_hwframe+0x63/0x6b

 Uninit was created at:
  free_pages_prepare mm/page_alloc.c:1087 [inline]
  free_unref_page_prepare+0xb0/0xa40 mm/page_alloc.c:2347
  free_unref_page_list+0xeb/0x1100 mm/page_alloc.c:2533
  release_pages+0x23d3/0x2410 mm/swap.c:1042
  free_pages_and_swap_cache+0xd9/0xf0 mm/swap_state.c:316
  tlb_batch_pages_flush mm/mmu_gather.c:98 [inline]
  tlb_flush_mmu_free mm/mmu_gather.c:293 [inline]
  tlb_flush_mmu+0x6f5/0x980 mm/mmu_gather.c:300
  tlb_finish_mmu+0x101/0x260 mm/mmu_gather.c:392
  exit_mmap+0x49e/0xd30 mm/mmap.c:3321
  __mmput+0x13f/0x530 kernel/fork.c:1349
  mmput+0x8a/0xa0 kernel/fork.c:1371
  exit_mm+0x1b8/0x360 kernel/exit.c:567
  do_exit+0xd57/0x4080 kernel/exit.c:858
  do_group_exit+0x2fd/0x390 kernel/exit.c:1021
  __do_sys_exit_group kernel/exit.c:1032 [inline]
  __se_sys_exit_group kernel/exit.c:1030 [inline]
  __x64_sys_exit_group+0x3c/0x50 kernel/exit.c:1030
  do_syscall_x64 arch/x86/entry/common.c:52 [inline]
  do_syscall_64+0x44/0x110 arch/x86/entry/common.c:83
  entry_SYSCALL_64_after_hwframe+0x63/0x6b

 Bytes 3852-3903 of 3904 are uninitialized
 Memory access of size 3904 starts at ffff88812ea1e000
 Data copied to user address 0000000020003280

 CPU: 1 PID: 5043 Comm: syz-executor297 Not tainted 6.7.0-rc5-syzkaller-00047-g5bd7ef53ffe5 #0
 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023

 The Linux kernel CVE team has assigned CVE-2024-26805 to this issue.


 Affected and fixed versions
 ===========================

 	Issue introduced in 4.3 with commit 1853c949646005b5959c483becde86608f548f24 and fixed in 4.19.309 with commit ec343a55b687a452f5e87f3b52bf9f155864df65
 	Issue introduced in 4.3 with commit 1853c949646005b5959c483becde86608f548f24 and fixed in 5.4.271 with commit 9ae51361da43270f4ba0eb924427a07e87e48777
 	Issue introduced in 4.3 with commit 1853c949646005b5959c483becde86608f548f24 and fixed in 5.10.212 with commit f19d1f98e60e68b11fc60839105dd02a30ec0d77
 	Issue introduced in 4.3 with commit 1853c949646005b5959c483becde86608f548f24 and fixed in 5.15.151 with commit c71ed29d15b1a1ed6c464f8c3536996963046285
 	Issue introduced in 4.3 with commit 1853c949646005b5959c483becde86608f548f24 and fixed in 6.1.81 with commit 0b27bf4c494d61e5663baa34c3edd7ccebf0ea44
 	Issue introduced in 4.3 with commit 1853c949646005b5959c483becde86608f548f24 and fixed in 6.6.21 with commit d3ada42e534a83b618bbc1e490d23bf0fdae4736
 	Issue introduced in 4.3 with commit 1853c949646005b5959c483becde86608f548f24 and fixed in 6.7.9 with commit 59fc3e3d049e39e7d0d271f20dd5fb47c57faf1d
 	Issue introduced in 4.3 with commit 1853c949646005b5959c483becde86608f548f24 and fixed in 6.8 with commit 661779e1fcafe1b74b3f3fe8e980c1e207fea1fd
 	Issue introduced in 3.12.49 with commit 92994a5f49d0a81c8643452d5c0a6e8b31d85a61
 	Issue introduced in 3.14.54 with commit 85aec6328f3346b0718211faad564a3ffa64f60e
 	Issue introduced in 3.18.23 with commit d38200098e3203ba30ba06ed3f345ec6ca75234c
 	Issue introduced in 4.1.10 with commit 65d48c630ff80a19c39751a4a6d3315f4c3c0280
 	Issue introduced in 4.2.3 with commit 62f43b58d2b2c4f0200b9ca2b997f4c484f0272f

 Please see https://www.kernel.org for a full list of currently supported
 kernel versions by the kernel community.

 Unaffected versions might change over time as fixes are backported to
 older supported kernel versions.  The official CVE entry at
 	https://cve.org/CVERecord/?id=CVE-2024-26805
 will be updated if fixes are backported, please check that for the most
 up to date information about this issue.


 Affected files
 ==============

 The file(s) affected by this issue are:
 	net/netlink/af_netlink.c


 Mitigation
 ==========

 The Linux kernel CVE team recommends that you update to the latest
 stable kernel version for this, and many other bugfixes.  Individual
 changes are never tested alone, but rather are part of a larger kernel
 release.  Cherry-picking individual commits is not recommended or
 supported by the Linux kernel community at all.  If however, updating to
 the latest release is impossible, the individual changes to resolve this
 issue can be found at these commits:
 	https://git.kernel.org/stable/c/ec343a55b687a452f5e87f3b52bf9f155864df65
 	https://git.kernel.org/stable/c/9ae51361da43270f4ba0eb924427a07e87e48777
 	https://git.kernel.org/stable/c/f19d1f98e60e68b11fc60839105dd02a30ec0d77
 	https://git.kernel.org/stable/c/c71ed29d15b1a1ed6c464f8c3536996963046285
 	https://git.kernel.org/stable/c/0b27bf4c494d61e5663baa34c3edd7ccebf0ea44
 	https://git.kernel.org/stable/c/d3ada42e534a83b618bbc1e490d23bf0fdae4736
 	https://git.kernel.org/stable/c/59fc3e3d049e39e7d0d271f20dd5fb47c57faf1d
 	https://git.kernel.org/stable/c/661779e1fcafe1b74b3f3fe8e980c1e207fea1fd
	From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001
	From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
	To: <linux-cve-announce@vger.kernel.org>
	Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org>
	Subject: CVE-2024-26805: netlink: Fix kernel-infoleak-after-free in __skb_datagram_iter

	Description
	===========

	In the Linux kernel, the following vulnerability has been resolved:

	netlink: Fix kernel-infoleak-after-free in __skb_datagram_iter

	syzbot reported the following uninit-value access issue [1]:

	netlink_to_full_skb() creates a new `skb` and puts the `skb->data`
	passed as a 1st arg of netlink_to_full_skb() onto new `skb`. The data
	size is specified as `len` and passed to skb_put_data(). This `len`
	is based on `skb->end` that is not data offset but buffer offset. The
	`skb->end` contains data and tailroom. Since the tailroom is not
	initialized when the new `skb` created, KMSAN detects uninitialized
	memory area when copying the data.

	This patch resolved this issue by correct the len from `skb->end` to
	`skb->len`, which is the actual data offset.

	BUG: KMSAN: kernel-infoleak-after-free in instrument_copy_to_user include/linux/instrumented.h:114 [inline]
	BUG: KMSAN: kernel-infoleak-after-free in copy_to_user_iter lib/iov_iter.c:24 [inline]
	BUG: KMSAN: kernel-infoleak-after-free in iterate_ubuf include/linux/iov_iter.h:29 [inline]
	BUG: KMSAN: kernel-infoleak-after-free in iterate_and_advance2 include/linux/iov_iter.h:245 [inline]
	BUG: KMSAN: kernel-infoleak-after-free in iterate_and_advance include/linux/iov_iter.h:271 [inline]
	BUG: KMSAN: kernel-infoleak-after-free in _copy_to_iter+0x364/0x2520 lib/iov_iter.c:186
	instrument_copy_to_user include/linux/instrumented.h:114 [inline]
	copy_to_user_iter lib/iov_iter.c:24 [inline]
	iterate_ubuf include/linux/iov_iter.h:29 [inline]
	iterate_and_advance2 include/linux/iov_iter.h:245 [inline]
	iterate_and_advance include/linux/iov_iter.h:271 [inline]
	_copy_to_iter+0x364/0x2520 lib/iov_iter.c:186
	copy_to_iter include/linux/uio.h:197 [inline]
	simple_copy_to_iter+0x68/0xa0 net/core/datagram.c:532
	__skb_datagram_iter+0x123/0xdc0 net/core/datagram.c:420
	skb_copy_datagram_iter+0x5c/0x200 net/core/datagram.c:546
	skb_copy_datagram_msg include/linux/skbuff.h:3960 [inline]
	packet_recvmsg+0xd9c/0x2000 net/packet/af_packet.c:3482
	sock_recvmsg_nosec net/socket.c:1044 [inline]
	sock_recvmsg net/socket.c:1066 [inline]
	sock_read_iter+0x467/0x580 net/socket.c:1136
	call_read_iter include/linux/fs.h:2014 [inline]
	new_sync_read fs/read_write.c:389 [inline]
	vfs_read+0x8f6/0xe00 fs/read_write.c:470
	ksys_read+0x20f/0x4c0 fs/read_write.c:613
	__do_sys_read fs/read_write.c:623 [inline]
	__se_sys_read fs/read_write.c:621 [inline]
	__x64_sys_read+0x93/0xd0 fs/read_write.c:621
	do_syscall_x64 arch/x86/entry/common.c:52 [inline]
	do_syscall_64+0x44/0x110 arch/x86/entry/common.c:83
	entry_SYSCALL_64_after_hwframe+0x63/0x6b

	Uninit was stored to memory at:
	skb_put_data include/linux/skbuff.h:2622 [inline]
	netlink_to_full_skb net/netlink/af_netlink.c:181 [inline]
	__netlink_deliver_tap_skb net/netlink/af_netlink.c:298 [inline]
	__netlink_deliver_tap+0x5be/0xc90 net/netlink/af_netlink.c:325
	netlink_deliver_tap net/netlink/af_netlink.c:338 [inline]
	netlink_deliver_tap_kernel net/netlink/af_netlink.c:347 [inline]
	netlink_unicast_kernel net/netlink/af_netlink.c:1341 [inline]
	netlink_unicast+0x10f1/0x1250 net/netlink/af_netlink.c:1368
	netlink_sendmsg+0x1238/0x13d0 net/netlink/af_netlink.c:1910
	sock_sendmsg_nosec net/socket.c:730 [inline]
	__sock_sendmsg net/socket.c:745 [inline]
	____sys_sendmsg+0x9c2/0xd60 net/socket.c:2584
	___sys_sendmsg+0x28d/0x3c0 net/socket.c:2638
	__sys_sendmsg net/socket.c:2667 [inline]
	__do_sys_sendmsg net/socket.c:2676 [inline]
	__se_sys_sendmsg net/socket.c:2674 [inline]
	__x64_sys_sendmsg+0x307/0x490 net/socket.c:2674
	do_syscall_x64 arch/x86/entry/common.c:52 [inline]
	do_syscall_64+0x44/0x110 arch/x86/entry/common.c:83
	entry_SYSCALL_64_after_hwframe+0x63/0x6b

	Uninit was created at:
	free_pages_prepare mm/page_alloc.c:1087 [inline]
	free_unref_page_prepare+0xb0/0xa40 mm/page_alloc.c:2347
	free_unref_page_list+0xeb/0x1100 mm/page_alloc.c:2533
	release_pages+0x23d3/0x2410 mm/swap.c:1042
	free_pages_and_swap_cache+0xd9/0xf0 mm/swap_state.c:316
	tlb_batch_pages_flush mm/mmu_gather.c:98 [inline]
	tlb_flush_mmu_free mm/mmu_gather.c:293 [inline]
	tlb_flush_mmu+0x6f5/0x980 mm/mmu_gather.c:300
	tlb_finish_mmu+0x101/0x260 mm/mmu_gather.c:392
	exit_mmap+0x49e/0xd30 mm/mmap.c:3321
	__mmput+0x13f/0x530 kernel/fork.c:1349
	mmput+0x8a/0xa0 kernel/fork.c:1371
	exit_mm+0x1b8/0x360 kernel/exit.c:567
	do_exit+0xd57/0x4080 kernel/exit.c:858
	do_group_exit+0x2fd/0x390 kernel/exit.c:1021
	__do_sys_exit_group kernel/exit.c:1032 [inline]
	__se_sys_exit_group kernel/exit.c:1030 [inline]
	__x64_sys_exit_group+0x3c/0x50 kernel/exit.c:1030
	do_syscall_x64 arch/x86/entry/common.c:52 [inline]
	do_syscall_64+0x44/0x110 arch/x86/entry/common.c:83
	entry_SYSCALL_64_after_hwframe+0x63/0x6b

	Bytes 3852-3903 of 3904 are uninitialized
	Memory access of size 3904 starts at ffff88812ea1e000
	Data copied to user address 0000000020003280

	CPU: 1 PID: 5043 Comm: syz-executor297 Not tainted 6.7.0-rc5-syzkaller-00047-g5bd7ef53ffe5 #0
	Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023

	The Linux kernel CVE team has assigned CVE-2024-26805 to this issue.


	Affected and fixed versions
	===========================

	Issue introduced in 4.3 with commit 1853c949646005b5959c483becde86608f548f24 and fixed in 4.19.309 with commit ec343a55b687a452f5e87f3b52bf9f155864df65
	Issue introduced in 4.3 with commit 1853c949646005b5959c483becde86608f548f24 and fixed in 5.4.271 with commit 9ae51361da43270f4ba0eb924427a07e87e48777
	Issue introduced in 4.3 with commit 1853c949646005b5959c483becde86608f548f24 and fixed in 5.10.212 with commit f19d1f98e60e68b11fc60839105dd02a30ec0d77
	Issue introduced in 4.3 with commit 1853c949646005b5959c483becde86608f548f24 and fixed in 5.15.151 with commit c71ed29d15b1a1ed6c464f8c3536996963046285
	Issue introduced in 4.3 with commit 1853c949646005b5959c483becde86608f548f24 and fixed in 6.1.81 with commit 0b27bf4c494d61e5663baa34c3edd7ccebf0ea44
	Issue introduced in 4.3 with commit 1853c949646005b5959c483becde86608f548f24 and fixed in 6.6.21 with commit d3ada42e534a83b618bbc1e490d23bf0fdae4736
	Issue introduced in 4.3 with commit 1853c949646005b5959c483becde86608f548f24 and fixed in 6.7.9 with commit 59fc3e3d049e39e7d0d271f20dd5fb47c57faf1d
	Issue introduced in 4.3 with commit 1853c949646005b5959c483becde86608f548f24 and fixed in 6.8 with commit 661779e1fcafe1b74b3f3fe8e980c1e207fea1fd
	Issue introduced in 3.12.49 with commit 92994a5f49d0a81c8643452d5c0a6e8b31d85a61
	Issue introduced in 3.14.54 with commit 85aec6328f3346b0718211faad564a3ffa64f60e
	Issue introduced in 3.18.23 with commit d38200098e3203ba30ba06ed3f345ec6ca75234c
	Issue introduced in 4.1.10 with commit 65d48c630ff80a19c39751a4a6d3315f4c3c0280
	Issue introduced in 4.2.3 with commit 62f43b58d2b2c4f0200b9ca2b997f4c484f0272f

	Please see https://www.kernel.org for a full list of currently supported
	kernel versions by the kernel community.

	Unaffected versions might change over time as fixes are backported to
	older supported kernel versions. The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2024-26805
	will be updated if fixes are backported, please check that for the most
	up to date information about this issue.


	Affected files
	==============

	The file(s) affected by this issue are:
	net/netlink/af_netlink.c


	Mitigation
	==========

	The Linux kernel CVE team recommends that you update to the latest
	stable kernel version for this, and many other bugfixes. Individual
	changes are never tested alone, but rather are part of a larger kernel
	release. Cherry-picking individual commits is not recommended or
	supported by the Linux kernel community at all. If however, updating to
	the latest release is impossible, the individual changes to resolve this
	issue can be found at these commits:
	https://git.kernel.org/stable/c/ec343a55b687a452f5e87f3b52bf9f155864df65
	https://git.kernel.org/stable/c/9ae51361da43270f4ba0eb924427a07e87e48777
	https://git.kernel.org/stable/c/f19d1f98e60e68b11fc60839105dd02a30ec0d77
	https://git.kernel.org/stable/c/c71ed29d15b1a1ed6c464f8c3536996963046285
	https://git.kernel.org/stable/c/0b27bf4c494d61e5663baa34c3edd7ccebf0ea44
	https://git.kernel.org/stable/c/d3ada42e534a83b618bbc1e490d23bf0fdae4736
	https://git.kernel.org/stable/c/59fc3e3d049e39e7d0d271f20dd5fb47c57faf1d
	https://git.kernel.org/stable/c/661779e1fcafe1b74b3f3fe8e980c1e207fea1fd