In the Linux kernel, the following vulnerability has been resolved:
geneve: make sure to pull inner header in geneve_rx()
syzbot triggered a bug in geneve_rx() [1]
Issue is similar to the one I fixed in commit 8d975c15c0cd ("ip6tunnel: make sure to pull inner header in _ip6tnlrcv()")
We have to save skb->networkheader in a temporary variable in order to be able to recompute the networkheader pointer after a pskbinetmay_pull() call.
pskbinetmay_pull() makes sure the needed headers are in skb->head.
[1] BUG: KMSAN: uninit-value in IPECNdecapsulate include/net/inetecn.h:302 [inline] BUG: KMSAN: uninit-value in geneverx drivers/net/geneve.c:279 [inline] BUG: KMSAN: uninit-value in geneveudpencaprecv+0x36f9/0x3c10 drivers/net/geneve.c:391 IPECNdecapsulate include/net/inetecn.h:302 [inline] geneverx drivers/net/geneve.c:279 [inline] geneveudpencaprecv+0x36f9/0x3c10 drivers/net/geneve.c:391 udpqueuercvoneskb+0x1d39/0x1f20 net/ipv4/udp.c:2108 udpqueuercvskb+0x6ae/0x6e0 net/ipv4/udp.c:2186 udpunicastrcvskb+0x184/0x4b0 net/ipv4/udp.c:2346 _udp4librcv+0x1c6b/0x3010 net/ipv4/udp.c:2422 udprcv+0x7d/0xa0 net/ipv4/udp.c:2604 ipprotocoldeliverrcu+0x264/0x1300 net/ipv4/ipinput.c:205 iplocaldeliverfinish+0x2b8/0x440 net/ipv4/ipinput.c:233 NFHOOK include/linux/netfilter.h:314 [inline] iplocaldeliver+0x21f/0x490 net/ipv4/ipinput.c:254 dstinput include/net/dst.h:461 [inline] iprcvfinish net/ipv4/ipinput.c:449 [inline] NFHOOK include/linux/netfilter.h:314 [inline] iprcv+0x46f/0x760 net/ipv4/ipinput.c:569 _netifreceiveskbonecore net/core/dev.c:5534 [inline] _netifreceiveskb+0x1a6/0x5a0 net/core/dev.c:5648 processbacklog+0x480/0x8b0 net/core/dev.c:5976 _napipoll+0xe3/0x980 net/core/dev.c:6576 napipoll net/core/dev.c:6645 [inline] netrxaction+0x8b8/0x1870 net/core/dev.c:6778 _dosoftirq+0x1b7/0x7c5 kernel/softirq.c:553 dosoftirq+0x9a/0xf0 kernel/softirq.c:454 _localbhenableip+0x9b/0xa0 kernel/softirq.c:381 localbhenable include/linux/bottomhalf.h:33 [inline] rcureadunlockbh include/linux/rcupdate.h:820 [inline] _devqueuexmit+0x2768/0x51c0 net/core/dev.c:4378 devqueuexmit include/linux/netdevice.h:3171 [inline] packetxmit+0x9c/0x6b0 net/packet/afpacket.c:276 packetsnd net/packet/afpacket.c:3081 [inline] packetsendmsg+0x8aef/0x9f10 net/packet/afpacket.c:3113 socksendmsgnosec net/socket.c:730 [inline] _socksendmsg net/socket.c:745 [inline] _syssendto+0x735/0xa10 net/socket.c:2191 _dosyssendto net/socket.c:2203 [inline] _sesyssendto net/socket.c:2199 [inline] _x64syssendto+0x125/0x1c0 net/socket.c:2199 dosyscallx64 arch/x86/entry/common.c:52 [inline] dosyscall64+0xcf/0x1e0 arch/x86/entry/common.c:83 entrySYSCALL64afterhwframe+0x63/0x6b
Uninit was created at: slabpostallochook mm/slub.c:3819 [inline] slaballocnode mm/slub.c:3860 [inline] kmemcacheallocnode+0x5cb/0xbc0 mm/slub.c:3903 kmallocreserve+0x13d/0x4a0 net/core/skbuff.c:560 _allocskb+0x352/0x790 net/core/skbuff.c:651 allocskb include/linux/skbuff.h:1296 [inline] allocskbwithfrags+0xc8/0xbd0 net/core/skbuff.c:6394 sockallocsendpskb+0xa80/0xbf0 net/core/sock.c:2783 packetallocskb net/packet/afpacket.c:2930 [inline] packetsnd net/packet/afpacket.c:3024 [inline] packetsendmsg+0x70c2/0x9f10 net/packet/afpacket.c:3113 socksendmsgnosec net/socket.c:730 [inline] _socksendmsg net/socket.c:745 [inline] _syssendto+0x735/0xa10 net/socket.c:2191 _dosyssendto net/socket.c:2203 [inline] _sesyssendto net/socket.c:2199 [inline] _x64syssendto+0x125/0x1c0 net/socket.c:2199 dosyscallx64 arch/x86/entry/common.c:52 [inline] dosyscall64+0xcf/0x1e0 arch/x86/entry/common.c:83 entrySYSCALL64afterhwframe+0x63/0x6b
[
{
"id": "CVE-2024-26857-113d76e1",
"target": {
"file": "drivers/net/geneve.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"79200096630129996005483276033558187413",
"253100291844025431777483912583163904509",
"159567800390840224663677285184259236924",
"324984200953933920796434203695093340865",
"147874835845291925833882166257262956585",
"140889152978839480649201899658975430850",
"160724665185392847160121537435854134204",
"206548649041154914595466412012922447231",
"213643830015338436878247859069275812199"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@59d2a4076983303f324557a114cfd5c32e1f6b29",
"signature_version": "v1"
},
{
"id": "CVE-2024-26857-13b95145",
"target": {
"file": "drivers/net/geneve.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"26904687185959396701643765843965504906",
"271509139778259444857987488473785802505",
"159567800390840224663677285184259236924",
"324984200953933920796434203695093340865",
"310991371030122359094104668322062817718",
"144930559026975973296983995704705055149",
"160724665185392847160121537435854134204",
"206548649041154914595466412012922447231",
"213643830015338436878247859069275812199"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1ca1ba465e55b9460e4e75dec9fff31e708fec74",
"signature_version": "v1"
},
{
"id": "CVE-2024-26857-1ca469df",
"target": {
"file": "drivers/net/geneve.c",
"function": "geneve_rx"
},
"digest": {
"length": 2014.0,
"function_hash": "9623125409758148614866312539088381161"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0ece581d2a66e8e488c0d3b3e7b5760dbbfdbdd5",
"signature_version": "v1"
},
{
"id": "CVE-2024-26857-1daf9c8b",
"target": {
"file": "drivers/net/geneve.c",
"function": "geneve_rx"
},
"digest": {
"length": 1865.0,
"function_hash": "55571706028792055580091441596523051765"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e77e0b0f2a11735c64b105edaee54d6344faca8a",
"signature_version": "v1"
},
{
"id": "CVE-2024-26857-7293485d",
"target": {
"file": "drivers/net/geneve.c",
"function": "geneve_rx"
},
"digest": {
"length": 1989.0,
"function_hash": "56324930596313563401379316989959200966"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@59d2a4076983303f324557a114cfd5c32e1f6b29",
"signature_version": "v1"
},
{
"id": "CVE-2024-26857-72c867bb",
"target": {
"file": "drivers/net/geneve.c",
"function": "geneve_rx"
},
"digest": {
"length": 2014.0,
"function_hash": "9623125409758148614866312539088381161"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c0b22568a9d8384fd000cc49acb8f74bde40d1b5",
"signature_version": "v1"
},
{
"id": "CVE-2024-26857-74ad50d9",
"target": {
"file": "drivers/net/geneve.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"26904687185959396701643765843965504906",
"271509139778259444857987488473785802505",
"159567800390840224663677285184259236924",
"324984200953933920796434203695093340865",
"147874835845291925833882166257262956585",
"140889152978839480649201899658975430850",
"160724665185392847160121537435854134204",
"206548649041154914595466412012922447231",
"213643830015338436878247859069275812199"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e77e0b0f2a11735c64b105edaee54d6344faca8a",
"signature_version": "v1"
},
{
"id": "CVE-2024-26857-91e5252a",
"target": {
"file": "drivers/net/geneve.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"26904687185959396701643765843965504906",
"271509139778259444857987488473785802505",
"159567800390840224663677285184259236924",
"324984200953933920796434203695093340865",
"310991371030122359094104668322062817718",
"144930559026975973296983995704705055149",
"160724665185392847160121537435854134204",
"206548649041154914595466412012922447231",
"213643830015338436878247859069275812199"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c0b22568a9d8384fd000cc49acb8f74bde40d1b5",
"signature_version": "v1"
},
{
"id": "CVE-2024-26857-9269b059",
"target": {
"file": "drivers/net/geneve.c",
"function": "geneve_rx"
},
"digest": {
"length": 2020.0,
"function_hash": "105959871879578801623108446515298862878"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1ca1ba465e55b9460e4e75dec9fff31e708fec74",
"signature_version": "v1"
},
{
"id": "CVE-2024-26857-9a9d5ee1",
"target": {
"file": "drivers/net/geneve.c",
"function": "geneve_rx"
},
"digest": {
"length": 1989.0,
"function_hash": "56324930596313563401379316989959200966"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e431c3227864b5646601c97f5f898d99472f2914",
"signature_version": "v1"
},
{
"id": "CVE-2024-26857-9ae73a5d",
"target": {
"file": "drivers/net/geneve.c",
"function": "geneve_rx"
},
"digest": {
"length": 1865.0,
"function_hash": "55571706028792055580091441596523051765"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c7137900691f5692fe3de54566ea7b30bb35d66c",
"signature_version": "v1"
},
{
"id": "CVE-2024-26857-d5e73583",
"target": {
"file": "drivers/net/geneve.c",
"function": "geneve_rx"
},
"digest": {
"length": 2014.0,
"function_hash": "9623125409758148614866312539088381161"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@048e16dee1fc609c1c85072ccd70bfd4b5fef6ca",
"signature_version": "v1"
},
{
"id": "CVE-2024-26857-df0cb529",
"target": {
"file": "drivers/net/geneve.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"26904687185959396701643765843965504906",
"271509139778259444857987488473785802505",
"159567800390840224663677285184259236924",
"324984200953933920796434203695093340865",
"310991371030122359094104668322062817718",
"144930559026975973296983995704705055149",
"160724665185392847160121537435854134204",
"206548649041154914595466412012922447231",
"213643830015338436878247859069275812199"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0ece581d2a66e8e488c0d3b3e7b5760dbbfdbdd5",
"signature_version": "v1"
},
{
"id": "CVE-2024-26857-f379e71a",
"target": {
"file": "drivers/net/geneve.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"79200096630129996005483276033558187413",
"253100291844025431777483912583163904509",
"159567800390840224663677285184259236924",
"324984200953933920796434203695093340865",
"147874835845291925833882166257262956585",
"140889152978839480649201899658975430850",
"160724665185392847160121537435854134204",
"206548649041154914595466412012922447231",
"213643830015338436878247859069275812199"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e431c3227864b5646601c97f5f898d99472f2914",
"signature_version": "v1"
},
{
"id": "CVE-2024-26857-f8468314",
"target": {
"file": "drivers/net/geneve.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"26904687185959396701643765843965504906",
"271509139778259444857987488473785802505",
"159567800390840224663677285184259236924",
"324984200953933920796434203695093340865",
"147874835845291925833882166257262956585",
"140889152978839480649201899658975430850",
"160724665185392847160121537435854134204",
"206548649041154914595466412012922447231",
"213643830015338436878247859069275812199"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c7137900691f5692fe3de54566ea7b30bb35d66c",
"signature_version": "v1"
},
{
"id": "CVE-2024-26857-fba725f8",
"target": {
"file": "drivers/net/geneve.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"26904687185959396701643765843965504906",
"271509139778259444857987488473785802505",
"159567800390840224663677285184259236924",
"324984200953933920796434203695093340865",
"310991371030122359094104668322062817718",
"144930559026975973296983995704705055149",
"160724665185392847160121537435854134204",
"206548649041154914595466412012922447231",
"213643830015338436878247859069275812199"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@048e16dee1fc609c1c85072ccd70bfd4b5fef6ca",
"signature_version": "v1"
}
]