In the Linux kernel, the following vulnerability has been resolved:
erspan: make sure erspanbasehdr is present in skb->head
syzbot reported a problem in ip6erspan_rcv() [1]
Issue is that ip6erspanrcv() (and erspanrcv()) no longer make sure erspanbasehdr is present in skb linear part (skb->head) before getting @ver field from it.
Add the missing pskbmaypull() calls.
v2: Reload iph pointer in erspanrcv() after pskbmay_pull() because skb->head might have changed.
[1]
BUG: KMSAN: uninit-value in pskbmaypullreason include/linux/skbuff.h:2742 [inline] BUG: KMSAN: uninit-value in pskbmaypull include/linux/skbuff.h:2756 [inline] BUG: KMSAN: uninit-value in ip6erspanrcv net/ipv6/ip6gre.c:541 [inline] BUG: KMSAN: uninit-value in grercv+0x11f8/0x1930 net/ipv6/ip6gre.c:610 pskbmaypullreason include/linux/skbuff.h:2742 [inline] pskbmaypull include/linux/skbuff.h:2756 [inline] ip6erspanrcv net/ipv6/ip6gre.c:541 [inline] grercv+0x11f8/0x1930 net/ipv6/ip6gre.c:610 ip6protocoldeliverrcu+0x1d4c/0x2ca0 net/ipv6/ip6input.c:438 ip6inputfinish net/ipv6/ip6input.c:483 [inline] NFHOOK include/linux/netfilter.h:314 [inline] ip6input+0x15d/0x430 net/ipv6/ip6input.c:492 ip6mcinput+0xa7e/0xc80 net/ipv6/ip6input.c:586 dstinput include/net/dst.h:460 [inline] ip6rcvfinish+0x955/0x970 net/ipv6/ip6input.c:79 NFHOOK include/linux/netfilter.h:314 [inline] ipv6rcv+0xde/0x390 net/ipv6/ip6input.c:310 _netifreceiveskbonecore net/core/dev.c:5538 [inline] _netifreceiveskb+0x1da/0xa00 net/core/dev.c:5652 netifreceiveskbinternal net/core/dev.c:5738 [inline] netifreceiveskb+0x58/0x660 net/core/dev.c:5798 tunrxbatched+0x3ee/0x980 drivers/net/tun.c:1549 tungetuser+0x5566/0x69e0 drivers/net/tun.c:2002 tunchrwriteiter+0x3af/0x5d0 drivers/net/tun.c:2048 callwriteiter include/linux/fs.h:2108 [inline] newsyncwrite fs/readwrite.c:497 [inline] vfswrite+0xb63/0x1520 fs/readwrite.c:590 ksyswrite+0x20f/0x4c0 fs/readwrite.c:643 _dosyswrite fs/readwrite.c:655 [inline] _sesyswrite fs/readwrite.c:652 [inline] _x64syswrite+0x93/0xe0 fs/readwrite.c:652 dosyscall64+0xd5/0x1f0 entrySYSCALL64after_hwframe+0x6d/0x75
Uninit was created at: slabpostallochook mm/slub.c:3804 [inline] slaballocnode mm/slub.c:3845 [inline] kmemcacheallocnode+0x613/0xc50 mm/slub.c:3888 kmallocreserve+0x13d/0x4a0 net/core/skbuff.c:577 _allocskb+0x35b/0x7a0 net/core/skbuff.c:668 allocskb include/linux/skbuff.h:1318 [inline] allocskbwithfrags+0xc8/0xbf0 net/core/skbuff.c:6504 sockallocsendpskb+0xa81/0xbf0 net/core/sock.c:2795 tunallocskb drivers/net/tun.c:1525 [inline] tungetuser+0x209a/0x69e0 drivers/net/tun.c:1846 tunchrwriteiter+0x3af/0x5d0 drivers/net/tun.c:2048 callwriteiter include/linux/fs.h:2108 [inline] newsyncwrite fs/readwrite.c:497 [inline] vfswrite+0xb63/0x1520 fs/readwrite.c:590 ksyswrite+0x20f/0x4c0 fs/readwrite.c:643 _dosyswrite fs/readwrite.c:655 [inline] _sesyswrite fs/readwrite.c:652 [inline] _x64syswrite+0x93/0xe0 fs/readwrite.c:652 dosyscall64+0xd5/0x1f0 entrySYSCALL64afterhwframe+0x6d/0x75
CPU: 1 PID: 5045 Comm: syz-executor114 Not tainted 6.9.0-rc1-syzkaller-00021-g962490525cff #0
[
{
"id": "CVE-2024-35888-0b9bd277",
"target": {
"file": "net/ipv4/ip_gre.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"198415810018883988696837597328544473287",
"17471749091142565581703768093435945092",
"233841111014747296010277523763309552236",
"290511904754091662373967214814893734750",
"154059883007639380925101925565007900833",
"280496382523879791351998133792024705791"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e54a0c79cdc2548729dd7e2e468b08c5af4d0df5",
"signature_version": "v1"
},
{
"id": "CVE-2024-35888-11e8eb52",
"target": {
"file": "net/ipv6/ip6_gre.c",
"function": "ip6erspan_rcv"
},
"digest": {
"function_hash": "58198672400172611334867092816460077280",
"length": 1389.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ee0088101beee10fa809716d6245d915b09c37c7",
"signature_version": "v1"
},
{
"id": "CVE-2024-35888-5b499656",
"target": {
"file": "net/ipv4/ip_gre.c",
"function": "erspan_rcv"
},
"digest": {
"function_hash": "216265699356150356619476432110737780225",
"length": 1755.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1db7fcb2b290c47c202b79528824f119fa28937d",
"signature_version": "v1"
},
{
"id": "CVE-2024-35888-6e1b3142",
"target": {
"file": "net/ipv6/ip6_gre.c",
"function": "ip6erspan_rcv"
},
"digest": {
"function_hash": "58198672400172611334867092816460077280",
"length": 1389.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e54a0c79cdc2548729dd7e2e468b08c5af4d0df5",
"signature_version": "v1"
},
{
"id": "CVE-2024-35888-6f07eba8",
"target": {
"file": "net/ipv4/ip_gre.c",
"function": "erspan_rcv"
},
"digest": {
"function_hash": "216265699356150356619476432110737780225",
"length": 1755.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ee0088101beee10fa809716d6245d915b09c37c7",
"signature_version": "v1"
},
{
"id": "CVE-2024-35888-7a8ff18f",
"target": {
"file": "net/ipv4/ip_gre.c",
"function": "erspan_rcv"
},
"digest": {
"function_hash": "216265699356150356619476432110737780225",
"length": 1755.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e54a0c79cdc2548729dd7e2e468b08c5af4d0df5",
"signature_version": "v1"
},
{
"id": "CVE-2024-35888-a5cfd677",
"target": {
"file": "net/ipv6/ip6_gre.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"148239489913151560069216698913958808503",
"258507672907708051054701873539020104624",
"179787855350526494892069401462868287454"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1db7fcb2b290c47c202b79528824f119fa28937d",
"signature_version": "v1"
},
{
"id": "CVE-2024-35888-ad5b5001",
"target": {
"file": "net/ipv6/ip6_gre.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"148239489913151560069216698913958808503",
"258507672907708051054701873539020104624",
"179787855350526494892069401462868287454"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ee0088101beee10fa809716d6245d915b09c37c7",
"signature_version": "v1"
},
{
"id": "CVE-2024-35888-ad7d5532",
"target": {
"file": "net/ipv6/ip6_gre.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"148239489913151560069216698913958808503",
"258507672907708051054701873539020104624",
"179787855350526494892069401462868287454"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e54a0c79cdc2548729dd7e2e468b08c5af4d0df5",
"signature_version": "v1"
},
{
"id": "CVE-2024-35888-bdfbf3cf",
"target": {
"file": "net/ipv4/ip_gre.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"198415810018883988696837597328544473287",
"17471749091142565581703768093435945092",
"233841111014747296010277523763309552236",
"290511904754091662373967214814893734750",
"154059883007639380925101925565007900833",
"280496382523879791351998133792024705791"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1db7fcb2b290c47c202b79528824f119fa28937d",
"signature_version": "v1"
},
{
"id": "CVE-2024-35888-da807630",
"target": {
"file": "net/ipv4/ip_gre.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"198415810018883988696837597328544473287",
"17471749091142565581703768093435945092",
"233841111014747296010277523763309552236",
"290511904754091662373967214814893734750",
"154059883007639380925101925565007900833",
"280496382523879791351998133792024705791"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ee0088101beee10fa809716d6245d915b09c37c7",
"signature_version": "v1"
},
{
"id": "CVE-2024-35888-f81a6cca",
"target": {
"file": "net/ipv6/ip6_gre.c",
"function": "ip6erspan_rcv"
},
"digest": {
"function_hash": "58198672400172611334867092816460077280",
"length": 1389.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1db7fcb2b290c47c202b79528824f119fa28937d",
"signature_version": "v1"
}
]