In the Linux kernel, the following vulnerability has been resolved:
ipv6: addrlabel: fix infoleak when sending struct ifaddrlblmsg to network
When copying a struct ifaddrlblmsg to the network, _ifalreserved
remained uninitialized, resulting in a 1-byte infoleak:
BUG: KMSAN: kernel-network-infoleak in _netdevstartxmit ./include/linux/netdevice.h:4841 _netdevstartxmit ./include/linux/netdevice.h:4841 netdevstartxmit ./include/linux/netdevice.h:4857 xmitone net/core/dev.c:3590 devhardstartxmit+0x1dc/0x800 net/core/dev.c:3606 _devqueuexmit+0x17e8/0x4350 net/core/dev.c:4256 devqueuexmit ./include/linux/netdevice.h:3009 _netlinkdelivertapskb net/netlink/afnetlink.c:307 _netlinkdelivertap+0x728/0xad0 net/netlink/afnetlink.c:325 netlinkdelivertap net/netlink/afnetlink.c:338 _netlinksendskb net/netlink/afnetlink.c:1263 netlinksendskb+0x1d9/0x200 net/netlink/afnetlink.c:1272 netlinkunicast+0x56d/0xf50 net/netlink/afnetlink.c:1360 nlmsgunicast ./include/net/netlink.h:1061 rtnlunicast+0x5a/0x80 net/core/rtnetlink.c:758 ip6addrlblget+0xfad/0x10f0 net/ipv6/addrlabel.c:628 rtnetlinkrcvmsg+0xb33/0x1570 net/core/rtnetlink.c:6082 ... Uninit was created at: slabpostallochook+0x118/0xb00 mm/slab.h:742 slaballocnode mm/slub.c:3398 _kmemcacheallocnode+0x4f2/0x930 mm/slub.c:3437 _dokmallocnode mm/slabcommon.c:954 _kmallocnodetrackcaller+0x117/0x3d0 mm/slabcommon.c:975 kmallocreserve net/core/skbuff.c:437 _allocskb+0x27a/0xab0 net/core/skbuff.c:509 allocskb ./include/linux/skbuff.h:1267 nlmsgnew ./include/net/netlink.h:964 ip6addrlblget+0x490/0x10f0 net/ipv6/addrlabel.c:608 rtnetlinkrcvmsg+0xb33/0x1570 net/core/rtnetlink.c:6082 netlinkrcvskb+0x299/0x550 net/netlink/afnetlink.c:2540 rtnetlinkrcv+0x26/0x30 net/core/rtnetlink.c:6109 netlinkunicastkernel net/netlink/afnetlink.c:1319 netlinkunicast+0x9ab/0xf50 net/netlink/afnetlink.c:1345 netlinksendmsg+0xebc/0x10f0 net/netlink/afnetlink.c:1921 ...
This patch ensures that the reserved field is always initialized.
[
{
"signature_version": "v1",
"digest": {
"function_hash": "126406860331595869611664588102080467512",
"length": 262.0
},
"deprecated": false,
"id": "CVE-2022-49865-02a8bba0",
"target": {
"function": "ip6addrlbl_putmsg",
"file": "net/ipv6/addrlabel.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@568a47ff756f913e8b374c2af9d22cd2c772c744",
"signature_type": "Function"
},
{
"signature_version": "v1",
"digest": {
"function_hash": "126406860331595869611664588102080467512",
"length": 262.0
},
"deprecated": false,
"id": "CVE-2022-49865-2a4268c4",
"target": {
"function": "ip6addrlbl_putmsg",
"file": "net/ipv6/addrlabel.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0f85b7ae7c4b5d7b4bbf7ac653a733c181a8a2bf",
"signature_type": "Function"
},
{
"signature_version": "v1",
"digest": {
"function_hash": "126406860331595869611664588102080467512",
"length": 262.0
},
"deprecated": false,
"id": "CVE-2022-49865-438d7054",
"target": {
"function": "ip6addrlbl_putmsg",
"file": "net/ipv6/addrlabel.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2acb2779b147decd300c117683d5a32ce61c75d6",
"signature_type": "Function"
},
{
"signature_version": "v1",
"digest": {
"function_hash": "126406860331595869611664588102080467512",
"length": 262.0
},
"deprecated": false,
"id": "CVE-2022-49865-497b1345",
"target": {
"function": "ip6addrlbl_putmsg",
"file": "net/ipv6/addrlabel.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@58cd7fdc8c1e6c7873acc08f190069fed88d1c12",
"signature_type": "Function"
},
{
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"267477213813970780994956068389492791494",
"336998371006142543083859661446162144703",
"293318653951076382138632700446947754140",
"173610839252007419658028493010092900787"
]
},
"deprecated": false,
"id": "CVE-2022-49865-526f0969",
"target": {
"file": "net/ipv6/addrlabel.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c23fb2c82267638f9d206cb96bb93e1f93ad7828",
"signature_type": "Line"
},
{
"signature_version": "v1",
"digest": {
"function_hash": "126406860331595869611664588102080467512",
"length": 262.0
},
"deprecated": false,
"id": "CVE-2022-49865-535a530a",
"target": {
"function": "ip6addrlbl_putmsg",
"file": "net/ipv6/addrlabel.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c23fb2c82267638f9d206cb96bb93e1f93ad7828",
"signature_type": "Function"
},
{
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"267477213813970780994956068389492791494",
"336998371006142543083859661446162144703",
"293318653951076382138632700446947754140",
"173610839252007419658028493010092900787"
]
},
"deprecated": false,
"id": "CVE-2022-49865-59ad6719",
"target": {
"file": "net/ipv6/addrlabel.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6d26d0587abccb9835382a0b53faa7b9b1cd83e3",
"signature_type": "Line"
},
{
"signature_version": "v1",
"digest": {
"function_hash": "126406860331595869611664588102080467512",
"length": 262.0
},
"deprecated": false,
"id": "CVE-2022-49865-80ab49f7",
"target": {
"function": "ip6addrlbl_putmsg",
"file": "net/ipv6/addrlabel.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@49e92ba5ecd7d72ba369dde2ccff738edd028a47",
"signature_type": "Function"
},
{
"signature_version": "v1",
"digest": {
"function_hash": "126406860331595869611664588102080467512",
"length": 262.0
},
"deprecated": false,
"id": "CVE-2022-49865-a9b618a3",
"target": {
"function": "ip6addrlbl_putmsg",
"file": "net/ipv6/addrlabel.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6d26d0587abccb9835382a0b53faa7b9b1cd83e3",
"signature_type": "Function"
},
{
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"267477213813970780994956068389492791494",
"336998371006142543083859661446162144703",
"293318653951076382138632700446947754140",
"173610839252007419658028493010092900787"
]
},
"deprecated": false,
"id": "CVE-2022-49865-c00e4655",
"target": {
"file": "net/ipv6/addrlabel.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@568a47ff756f913e8b374c2af9d22cd2c772c744",
"signature_type": "Line"
},
{
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"267477213813970780994956068389492791494",
"336998371006142543083859661446162144703",
"293318653951076382138632700446947754140",
"173610839252007419658028493010092900787"
]
},
"deprecated": false,
"id": "CVE-2022-49865-c1da2913",
"target": {
"file": "net/ipv6/addrlabel.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@49e92ba5ecd7d72ba369dde2ccff738edd028a47",
"signature_type": "Line"
},
{
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"267477213813970780994956068389492791494",
"336998371006142543083859661446162144703",
"293318653951076382138632700446947754140",
"173610839252007419658028493010092900787"
]
},
"deprecated": false,
"id": "CVE-2022-49865-d1016c33",
"target": {
"file": "net/ipv6/addrlabel.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@58cd7fdc8c1e6c7873acc08f190069fed88d1c12",
"signature_type": "Line"
},
{
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"267477213813970780994956068389492791494",
"336998371006142543083859661446162144703",
"293318653951076382138632700446947754140",
"173610839252007419658028493010092900787"
]
},
"deprecated": false,
"id": "CVE-2022-49865-d89a4666",
"target": {
"file": "net/ipv6/addrlabel.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a033b86c7f7621fde31f0364af8986f43b44914f",
"signature_type": "Line"
},
{
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"267477213813970780994956068389492791494",
"336998371006142543083859661446162144703",
"293318653951076382138632700446947754140",
"173610839252007419658028493010092900787"
]
},
"deprecated": false,
"id": "CVE-2022-49865-de513678",
"target": {
"file": "net/ipv6/addrlabel.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2acb2779b147decd300c117683d5a32ce61c75d6",
"signature_type": "Line"
},
{
"signature_version": "v1",
"digest": {
"function_hash": "126406860331595869611664588102080467512",
"length": 262.0
},
"deprecated": false,
"id": "CVE-2022-49865-fbca4628",
"target": {
"function": "ip6addrlbl_putmsg",
"file": "net/ipv6/addrlabel.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a033b86c7f7621fde31f0364af8986f43b44914f",
"signature_type": "Function"
},
{
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"267477213813970780994956068389492791494",
"336998371006142543083859661446162144703",
"293318653951076382138632700446947754140",
"173610839252007419658028493010092900787"
]
},
"deprecated": false,
"id": "CVE-2022-49865-fe17529a",
"target": {
"file": "net/ipv6/addrlabel.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0f85b7ae7c4b5d7b4bbf7ac653a733c181a8a2bf",
"signature_type": "Line"
}
]