In the Linux kernel, the following vulnerability has been resolved:
dccp: fix dccpv4err()/dccpv6err() again
dh->dccphx is the 9th byte (offset 8) in "struct dccphdr", not in the "byte 7" as Jann claimed.
We need to make sure the ICMP messages are big enough, using more standard ways (no more assumptions).
syzbot reported: BUG: KMSAN: uninit-value in pskbmaypullreason include/linux/skbuff.h:2667 [inline] BUG: KMSAN: uninit-value in pskbmaypull include/linux/skbuff.h:2681 [inline] BUG: KMSAN: uninit-value in dccpv6err+0x426/0x1aa0 net/dccp/ipv6.c:94 pskbmaypullreason include/linux/skbuff.h:2667 [inline] pskbmaypull include/linux/skbuff.h:2681 [inline] dccpv6err+0x426/0x1aa0 net/dccp/ipv6.c:94 icmpv6notify+0x4c7/0x880 net/ipv6/icmp.c:867 icmpv6rcv+0x19d5/0x30d0 ip6protocoldeliverrcu+0xda6/0x2a60 net/ipv6/ip6input.c:438 ip6inputfinish net/ipv6/ip6input.c:483 [inline] NFHOOK include/linux/netfilter.h:304 [inline] ip6input+0x15d/0x430 net/ipv6/ip6input.c:492 ip6mcinput+0xa7e/0xc80 net/ipv6/ip6input.c:586 dstinput include/net/dst.h:468 [inline] ip6rcvfinish+0x5db/0x870 net/ipv6/ip6input.c:79 NFHOOK include/linux/netfilter.h:304 [inline] ipv6rcv+0xda/0x390 net/ipv6/ip6input.c:310 _netifreceiveskbonecore net/core/dev.c:5523 [inline] _netifreceiveskb+0x1a6/0x5a0 net/core/dev.c:5637 netifreceiveskbinternal net/core/dev.c:5723 [inline] netifreceiveskb+0x58/0x660 net/core/dev.c:5782 tunrxbatched+0x83b/0x920 tungetuser+0x564c/0x6940 drivers/net/tun.c:2002 tunchrwriteiter+0x3af/0x5d0 drivers/net/tun.c:2048 callwriteiter include/linux/fs.h:1985 [inline] newsyncwrite fs/readwrite.c:491 [inline] vfswrite+0x8ef/0x15c0 fs/readwrite.c:584 ksyswrite+0x20f/0x4c0 fs/readwrite.c:637 _dosyswrite fs/readwrite.c:649 [inline] _sesyswrite fs/readwrite.c:646 [inline] _x64syswrite+0x93/0xd0 fs/readwrite.c:646 dosyscallx64 arch/x86/entry/common.c:50 [inline] dosyscall64+0x41/0xc0 arch/x86/entry/common.c:80 entrySYSCALL64after_hwframe+0x63/0xcd
Uninit was created at: slabpostallochook+0x12f/0xb70 mm/slab.h:767 slaballocnode mm/slub.c:3478 [inline] kmemcacheallocnode+0x577/0xa80 mm/slub.c:3523 kmallocreserve+0x13d/0x4a0 net/core/skbuff.c:559 _allocskb+0x318/0x740 net/core/skbuff.c:650 allocskb include/linux/skbuff.h:1286 [inline] allocskbwithfrags+0xc8/0xbd0 net/core/skbuff.c:6313 sockallocsendpskb+0xa80/0xbf0 net/core/sock.c:2795 tunallocskb drivers/net/tun.c:1531 [inline] tungetuser+0x23cf/0x6940 drivers/net/tun.c:1846 tunchrwriteiter+0x3af/0x5d0 drivers/net/tun.c:2048 callwriteiter include/linux/fs.h:1985 [inline] newsyncwrite fs/readwrite.c:491 [inline] vfswrite+0x8ef/0x15c0 fs/readwrite.c:584 ksyswrite+0x20f/0x4c0 fs/readwrite.c:637 _dosyswrite fs/readwrite.c:649 [inline] _sesyswrite fs/readwrite.c:646 [inline] _x64syswrite+0x93/0xd0 fs/readwrite.c:646 dosyscallx64 arch/x86/entry/common.c:50 [inline] dosyscall64+0x41/0xc0 arch/x86/entry/common.c:80 entrySYSCALL64afterhwframe+0x63/0xcd
CPU: 0 PID: 4995 Comm: syz-executor153 Not tainted 6.6.0-rc1-syzkaller-00014-ga747acc0b752 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/04/2023
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@26df9ab5de308caa1503d937533c56c35793018d",
"id": "CVE-2023-52577-127e4bc3",
"deprecated": false,
"target": {
"file": "net/dccp/ipv4.c"
},
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"13253540246275055428365492573472144084",
"119482668534834511064843235652859922749",
"30282246620717339575161550180448603235"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1512d8f45d3c5d0b5baa00bd8e600492fa569f40",
"id": "CVE-2023-52577-1649cbe5",
"deprecated": false,
"target": {
"function": "dccp_v4_err",
"file": "net/dccp/ipv4.c"
},
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 2302.0,
"function_hash": "96213685515887977371918273537289650373"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6af289746a636f71f4c0535a9801774118486c7a",
"id": "CVE-2023-52577-16535ebe",
"deprecated": false,
"target": {
"function": "dccp_v4_err",
"file": "net/dccp/ipv4.c"
},
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 2275.0,
"function_hash": "106095298059630631557136717403520364090"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@60d73c62e3e4464f375758b6f2459c13d46465b6",
"id": "CVE-2023-52577-1ccb4f52",
"deprecated": false,
"target": {
"file": "net/dccp/ipv6.c"
},
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"280317919854257873172157375059658189277",
"337442058864136369610734617974451797210",
"30282246620717339575161550180448603235"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@60d73c62e3e4464f375758b6f2459c13d46465b6",
"id": "CVE-2023-52577-1ea25e59",
"deprecated": false,
"target": {
"function": "dccp_v6_err",
"file": "net/dccp/ipv6.c"
},
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 2372.0,
"function_hash": "151615503328016058776248011521103625195"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4600beae416d754a3cedbb1ecea8181ec05073b6",
"id": "CVE-2023-52577-29ba6a16",
"deprecated": false,
"target": {
"function": "dccp_v4_err",
"file": "net/dccp/ipv4.c"
},
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 2257.0,
"function_hash": "7682781702202714037829302653864338633"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@26df9ab5de308caa1503d937533c56c35793018d",
"id": "CVE-2023-52577-32479667",
"deprecated": false,
"target": {
"function": "dccp_v4_err",
"file": "net/dccp/ipv4.c"
},
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 2268.0,
"function_hash": "321593156407046255569693328562083598873"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@62c218124fe58372e0e1f60d5b634d21c264b337",
"id": "CVE-2023-52577-3bb7e7e8",
"deprecated": false,
"target": {
"function": "dccp_v4_err",
"file": "net/dccp/ipv4.c"
},
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 2257.0,
"function_hash": "7682781702202714037829302653864338633"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@73be49248a04746096339a48a33fa2f03bd85969",
"id": "CVE-2023-52577-445fae0a",
"deprecated": false,
"target": {
"file": "net/dccp/ipv6.c"
},
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"280317919854257873172157375059658189277",
"337442058864136369610734617974451797210",
"30282246620717339575161550180448603235"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@60d73c62e3e4464f375758b6f2459c13d46465b6",
"id": "CVE-2023-52577-8d314a49",
"deprecated": false,
"target": {
"function": "dccp_v4_err",
"file": "net/dccp/ipv4.c"
},
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 2296.0,
"function_hash": "101326921935023630166628351546899239235"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4600beae416d754a3cedbb1ecea8181ec05073b6",
"id": "CVE-2023-52577-9506ed7b",
"deprecated": false,
"target": {
"file": "net/dccp/ipv6.c"
},
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"280317919854257873172157375059658189277",
"337442058864136369610734617974451797210",
"6793852386054311318618327864296548612"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@62c218124fe58372e0e1f60d5b634d21c264b337",
"id": "CVE-2023-52577-9ca56a09",
"deprecated": false,
"target": {
"file": "net/dccp/ipv4.c"
},
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"13253540246275055428365492573472144084",
"119482668534834511064843235652859922749",
"6793852386054311318618327864296548612"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6af289746a636f71f4c0535a9801774118486c7a",
"id": "CVE-2023-52577-a055844e",
"deprecated": false,
"target": {
"function": "dccp_v6_err",
"file": "net/dccp/ipv6.c"
},
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 2378.0,
"function_hash": "195632145110471982180844675791768610571"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6af289746a636f71f4c0535a9801774118486c7a",
"id": "CVE-2023-52577-ae646c08",
"deprecated": false,
"target": {
"file": "net/dccp/ipv4.c"
},
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"13253540246275055428365492573472144084",
"119482668534834511064843235652859922749",
"30282246620717339575161550180448603235"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@73be49248a04746096339a48a33fa2f03bd85969",
"id": "CVE-2023-52577-b0e67d3a",
"deprecated": false,
"target": {
"function": "dccp_v4_err",
"file": "net/dccp/ipv4.c"
},
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 2268.0,
"function_hash": "321593156407046255569693328562083598873"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@73be49248a04746096339a48a33fa2f03bd85969",
"id": "CVE-2023-52577-b5159f42",
"deprecated": false,
"target": {
"file": "net/dccp/ipv4.c"
},
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"13253540246275055428365492573472144084",
"119482668534834511064843235652859922749",
"30282246620717339575161550180448603235"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1512d8f45d3c5d0b5baa00bd8e600492fa569f40",
"id": "CVE-2023-52577-b5691417",
"deprecated": false,
"target": {
"function": "dccp_v6_err",
"file": "net/dccp/ipv6.c"
},
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 2378.0,
"function_hash": "195632145110471982180844675791768610571"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@26df9ab5de308caa1503d937533c56c35793018d",
"id": "CVE-2023-52577-bbcbfb3e",
"deprecated": false,
"target": {
"file": "net/dccp/ipv6.c"
},
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"280317919854257873172157375059658189277",
"337442058864136369610734617974451797210",
"30282246620717339575161550180448603235"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4600beae416d754a3cedbb1ecea8181ec05073b6",
"id": "CVE-2023-52577-be113f11",
"deprecated": false,
"target": {
"file": "net/dccp/ipv4.c"
},
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"13253540246275055428365492573472144084",
"119482668534834511064843235652859922749",
"6793852386054311318618327864296548612"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@26df9ab5de308caa1503d937533c56c35793018d",
"id": "CVE-2023-52577-c0c5af33",
"deprecated": false,
"target": {
"function": "dccp_v6_err",
"file": "net/dccp/ipv6.c"
},
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 2344.0,
"function_hash": "289981651512814975713247413349345467662"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@62c218124fe58372e0e1f60d5b634d21c264b337",
"id": "CVE-2023-52577-c9e37aa8",
"deprecated": false,
"target": {
"function": "dccp_v6_err",
"file": "net/dccp/ipv6.c"
},
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 2333.0,
"function_hash": "172740732761295182719881310310430399158"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4600beae416d754a3cedbb1ecea8181ec05073b6",
"id": "CVE-2023-52577-cd3a973d",
"deprecated": false,
"target": {
"function": "dccp_v6_err",
"file": "net/dccp/ipv6.c"
},
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 2333.0,
"function_hash": "172740732761295182719881310310430399158"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6af289746a636f71f4c0535a9801774118486c7a",
"id": "CVE-2023-52577-d0867d8a",
"deprecated": false,
"target": {
"file": "net/dccp/ipv6.c"
},
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"280317919854257873172157375059658189277",
"337442058864136369610734617974451797210",
"30282246620717339575161550180448603235"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1512d8f45d3c5d0b5baa00bd8e600492fa569f40",
"id": "CVE-2023-52577-dc9fdc0b",
"deprecated": false,
"target": {
"file": "net/dccp/ipv4.c"
},
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"13253540246275055428365492573472144084",
"119482668534834511064843235652859922749",
"30282246620717339575161550180448603235"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@73be49248a04746096339a48a33fa2f03bd85969",
"id": "CVE-2023-52577-e555c710",
"deprecated": false,
"target": {
"function": "dccp_v6_err",
"file": "net/dccp/ipv6.c"
},
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 2344.0,
"function_hash": "289981651512814975713247413349345467662"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1512d8f45d3c5d0b5baa00bd8e600492fa569f40",
"id": "CVE-2023-52577-ec925757",
"deprecated": false,
"target": {
"file": "net/dccp/ipv6.c"
},
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"280317919854257873172157375059658189277",
"337442058864136369610734617974451797210",
"30282246620717339575161550180448603235"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@62c218124fe58372e0e1f60d5b634d21c264b337",
"id": "CVE-2023-52577-fa81e89a",
"deprecated": false,
"target": {
"file": "net/dccp/ipv6.c"
},
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"280317919854257873172157375059658189277",
"337442058864136369610734617974451797210",
"6793852386054311318618327864296548612"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@60d73c62e3e4464f375758b6f2459c13d46465b6",
"id": "CVE-2023-52577-fad9e415",
"deprecated": false,
"target": {
"file": "net/dccp/ipv4.c"
},
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"13253540246275055428365492573472144084",
"119482668534834511064843235652859922749",
"30282246620717339575161550180448603235"
]
}
}
]