In the Linux kernel, the following vulnerability has been resolved:
can: bcm: bcmtxsetup(): fix KMSAN uninit-value in vfs_write
Syzkaller reported the following issue:
===================================================== BUG: KMSAN: uninit-value in aiorwdone fs/aio.c:1520 [inline] BUG: KMSAN: uninit-value in aiowrite+0x899/0x950 fs/aio.c:1600 aiorwdone fs/aio.c:1520 [inline] aiowrite+0x899/0x950 fs/aio.c:1600 iosubmitone+0x1d1c/0x3bf0 fs/aio.c:2019 _dosysiosubmit fs/aio.c:2078 [inline] _sesysiosubmit+0x293/0x770 fs/aio.c:2048 _x64sysiosubmit+0x92/0xd0 fs/aio.c:2048 dosyscallx64 arch/x86/entry/common.c:50 [inline] dosyscall64+0x3d/0xb0 arch/x86/entry/common.c:80 entrySYSCALL64afterhwframe+0x63/0xcd
Uninit was created at: slabpostallochook mm/slab.h:766 [inline] slaballocnode mm/slub.c:3452 [inline] _kmemcacheallocnode+0x71f/0xce0 mm/slub.c:3491 _dokmallocnode mm/slabcommon.c:967 [inline] _kmalloc+0x11d/0x3b0 mm/slabcommon.c:981 kmallocarray include/linux/slab.h:636 [inline] bcmtxsetup+0x80e/0x29d0 net/can/bcm.c:930 bcmsendmsg+0x3a2/0xce0 net/can/bcm.c:1351 socksendmsgnosec net/socket.c:714 [inline] socksendmsg net/socket.c:734 [inline] sockwriteiter+0x495/0x5e0 net/socket.c:1108 callwriteiter include/linux/fs.h:2189 [inline] aiowrite+0x63a/0x950 fs/aio.c:1600 iosubmitone+0x1d1c/0x3bf0 fs/aio.c:2019 _dosysiosubmit fs/aio.c:2078 [inline] _sesysiosubmit+0x293/0x770 fs/aio.c:2048 _x64sysiosubmit+0x92/0xd0 fs/aio.c:2048 dosyscallx64 arch/x86/entry/common.c:50 [inline] dosyscall64+0x3d/0xb0 arch/x86/entry/common.c:80 entrySYSCALL64after_hwframe+0x63/0xcd
CPU: 1 PID: 5034 Comm: syz-executor350 Not tainted 6.2.0-rc6-syzkaller-80422-geda666ff2276 #0
We can follow the call chain and find that 'bcmtxsetup' function calls 'memcpyfrommsg' to copy some content to the newly allocated frame of 'op->frames'. After that the 'len' field of copied structure being compared with some constant value (64 or 8). However, if 'memcpyfrommsg' returns an error, we will compare some uninitialized memory. This triggers 'uninit-value' issue.
This patch will add 'memcpyfrommsg' possible errors processing to avoid uninit-value issue.
Tested via syzkaller
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@78bc7f0ab99458221224d3ab97199c0f8e6861f1",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "net/can/bcm.c"
},
"id": "CVE-2023-53344-012c8ab3",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"45899021808997588521888813783756720592",
"314297154155659958407536872955052832113",
"153970317303254441467767006573521921421",
"37757461386947294969611874350175532486",
"111271836601451153327077272002542800535",
"239139857251754175362631185163115926322",
"22704476944773983376976525424257027471",
"107386290082239042559389105876991616072",
"251092008116308527483597382055731055017",
"182217220700322955831047721779632190345",
"149747897476782406694998949925549476389",
"17645184216014841634997126591873489301",
"146413177122655871163471008349447355284",
"109329952443964987181275926528199998286",
"102243594370373137932070851841076851668",
"103670709613608457083870889565161201728",
"158005085050753180120388337038378740769"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bf70e0eab64c625da84d9fdf4e84466b79418920",
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "bcm_tx_setup",
"file": "net/can/bcm.c"
},
"id": "CVE-2023-53344-13637d33",
"signature_type": "Function",
"digest": {
"length": 2889.0,
"function_hash": "73465914289538307280108778655021664361"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2e6ad51c709fa794e0ce26003c9c9cd944e3383a",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "net/can/bcm.c"
},
"id": "CVE-2023-53344-1d12b5c7",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"45899021808997588521888813783756720592",
"314297154155659958407536872955052832113",
"153970317303254441467767006573521921421",
"37757461386947294969611874350175532486",
"111271836601451153327077272002542800535",
"239139857251754175362631185163115926322",
"22704476944773983376976525424257027471",
"107386290082239042559389105876991616072",
"251092008116308527483597382055731055017",
"182217220700322955831047721779632190345",
"149747897476782406694998949925549476389",
"17645184216014841634997126591873489301",
"146413177122655871163471008349447355284",
"109329952443964987181275926528199998286",
"102243594370373137932070851841076851668",
"103670709613608457083870889565161201728",
"158005085050753180120388337038378740769"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3fa0f1e0e31b1b73cdf59d4c36c7242e6ef821be",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "net/can/bcm.c"
},
"id": "CVE-2023-53344-4e1ab5c2",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"45899021808997588521888813783756720592",
"314297154155659958407536872955052832113",
"153970317303254441467767006573521921421",
"37757461386947294969611874350175532486",
"111271836601451153327077272002542800535",
"239139857251754175362631185163115926322",
"22704476944773983376976525424257027471",
"107386290082239042559389105876991616072",
"251092008116308527483597382055731055017",
"182217220700322955831047721779632190345",
"149747897476782406694998949925549476389",
"17645184216014841634997126591873489301",
"146413177122655871163471008349447355284",
"109329952443964987181275926528199998286",
"102243594370373137932070851841076851668",
"103670709613608457083870889565161201728",
"158005085050753180120388337038378740769"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@618b15d09fed6126356101543451d49860db4388",
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "bcm_tx_setup",
"file": "net/can/bcm.c"
},
"id": "CVE-2023-53344-63974c42",
"signature_type": "Function",
"digest": {
"length": 2889.0,
"function_hash": "73465914289538307280108778655021664361"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2e6ad51c709fa794e0ce26003c9c9cd944e3383a",
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "bcm_tx_setup",
"file": "net/can/bcm.c"
},
"id": "CVE-2023-53344-6f31c2e7",
"signature_type": "Function",
"digest": {
"length": 2889.0,
"function_hash": "73465914289538307280108778655021664361"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c11dbc7705b3739974ac31a13f4ab81e61a5fb07",
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "bcm_tx_setup",
"file": "net/can/bcm.c"
},
"id": "CVE-2023-53344-7b6e1a3b",
"signature_type": "Function",
"digest": {
"length": 2889.0,
"function_hash": "73465914289538307280108778655021664361"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bf70e0eab64c625da84d9fdf4e84466b79418920",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "net/can/bcm.c"
},
"id": "CVE-2023-53344-8a71f544",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"45899021808997588521888813783756720592",
"314297154155659958407536872955052832113",
"153970317303254441467767006573521921421",
"37757461386947294969611874350175532486",
"111271836601451153327077272002542800535",
"239139857251754175362631185163115926322",
"22704476944773983376976525424257027471",
"107386290082239042559389105876991616072",
"251092008116308527483597382055731055017",
"182217220700322955831047721779632190345",
"149747897476782406694998949925549476389",
"17645184216014841634997126591873489301",
"146413177122655871163471008349447355284",
"109329952443964987181275926528199998286",
"102243594370373137932070851841076851668",
"103670709613608457083870889565161201728",
"158005085050753180120388337038378740769"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@78bc7f0ab99458221224d3ab97199c0f8e6861f1",
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "bcm_tx_setup",
"file": "net/can/bcm.c"
},
"id": "CVE-2023-53344-90a13dd7",
"signature_type": "Function",
"digest": {
"length": 2889.0,
"function_hash": "73465914289538307280108778655021664361"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2b4c99f7d9a57ecd644eda9b1fb0a1072414959f",
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "bcm_tx_setup",
"file": "net/can/bcm.c"
},
"id": "CVE-2023-53344-941a69e9",
"signature_type": "Function",
"digest": {
"length": 2889.0,
"function_hash": "73465914289538307280108778655021664361"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3fa0f1e0e31b1b73cdf59d4c36c7242e6ef821be",
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "bcm_tx_setup",
"file": "net/can/bcm.c"
},
"id": "CVE-2023-53344-9e890297",
"signature_type": "Function",
"digest": {
"length": 2959.0,
"function_hash": "160475313193389288308297814665093108052"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ab2a55907823f0bca56b6d03ea05e4071ba8535f",
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "bcm_tx_setup",
"file": "net/can/bcm.c"
},
"id": "CVE-2023-53344-ab80a558",
"signature_type": "Function",
"digest": {
"length": 2889.0,
"function_hash": "73465914289538307280108778655021664361"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c11dbc7705b3739974ac31a13f4ab81e61a5fb07",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "net/can/bcm.c"
},
"id": "CVE-2023-53344-b1890355",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"45899021808997588521888813783756720592",
"314297154155659958407536872955052832113",
"153970317303254441467767006573521921421",
"37757461386947294969611874350175532486",
"111271836601451153327077272002542800535",
"239139857251754175362631185163115926322",
"22704476944773983376976525424257027471",
"107386290082239042559389105876991616072",
"251092008116308527483597382055731055017",
"182217220700322955831047721779632190345",
"149747897476782406694998949925549476389",
"17645184216014841634997126591873489301",
"146413177122655871163471008349447355284",
"109329952443964987181275926528199998286",
"102243594370373137932070851841076851668",
"103670709613608457083870889565161201728",
"158005085050753180120388337038378740769"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2b4c99f7d9a57ecd644eda9b1fb0a1072414959f",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "net/can/bcm.c"
},
"id": "CVE-2023-53344-c08395d2",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"45899021808997588521888813783756720592",
"314297154155659958407536872955052832113",
"153970317303254441467767006573521921421",
"37757461386947294969611874350175532486",
"111271836601451153327077272002542800535",
"239139857251754175362631185163115926322",
"22704476944773983376976525424257027471",
"107386290082239042559389105876991616072",
"251092008116308527483597382055731055017",
"182217220700322955831047721779632190345",
"149747897476782406694998949925549476389",
"17645184216014841634997126591873489301",
"146413177122655871163471008349447355284",
"109329952443964987181275926528199998286",
"102243594370373137932070851841076851668",
"103670709613608457083870889565161201728",
"158005085050753180120388337038378740769"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ab2a55907823f0bca56b6d03ea05e4071ba8535f",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "net/can/bcm.c"
},
"id": "CVE-2023-53344-cb82ab68",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"45899021808997588521888813783756720592",
"314297154155659958407536872955052832113",
"153970317303254441467767006573521921421",
"37757461386947294969611874350175532486",
"111271836601451153327077272002542800535",
"239139857251754175362631185163115926322",
"22704476944773983376976525424257027471",
"107386290082239042559389105876991616072",
"251092008116308527483597382055731055017",
"182217220700322955831047721779632190345",
"149747897476782406694998949925549476389",
"17645184216014841634997126591873489301",
"146413177122655871163471008349447355284",
"109329952443964987181275926528199998286",
"102243594370373137932070851841076851668",
"103670709613608457083870889565161201728",
"158005085050753180120388337038378740769"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@618b15d09fed6126356101543451d49860db4388",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "net/can/bcm.c"
},
"id": "CVE-2023-53344-eb1be9bd",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"45899021808997588521888813783756720592",
"314297154155659958407536872955052832113",
"153970317303254441467767006573521921421",
"37757461386947294969611874350175532486",
"111271836601451153327077272002542800535",
"239139857251754175362631185163115926322",
"22704476944773983376976525424257027471",
"107386290082239042559389105876991616072",
"251092008116308527483597382055731055017",
"182217220700322955831047721779632190345",
"149747897476782406694998949925549476389",
"17645184216014841634997126591873489301",
"146413177122655871163471008349447355284",
"109329952443964987181275926528199998286",
"102243594370373137932070851841076851668",
"103670709613608457083870889565161201728",
"158005085050753180120388337038378740769"
]
}
}
]