In the Linux kernel, the following vulnerability has been resolved:
net/sched: act_skbmod: prevent kernel-infoleak
syzbot found that tcfskbmoddump() was copying four bytes from kernel stack to user space [1].
The issue here is that 'struct tc_skbmod' has a four bytes hole.
We need to clear the structure before filling fields.
[1] BUG: KMSAN: kernel-infoleak in instrumentcopytouser include/linux/instrumented.h:114 [inline] BUG: KMSAN: kernel-infoleak in copytouseriter lib/ioviter.c:24 [inline] BUG: KMSAN: kernel-infoleak in iterateubuf include/linux/ioviter.h:29 [inline] BUG: KMSAN: kernel-infoleak in iterateandadvance2 include/linux/ioviter.h:245 [inline] BUG: KMSAN: kernel-infoleak in iterateandadvance include/linux/ioviter.h:271 [inline] BUG: KMSAN: kernel-infoleak in _copytoiter+0x366/0x2520 lib/ioviter.c:185 instrumentcopytouser include/linux/instrumented.h:114 [inline] copytouseriter lib/ioviter.c:24 [inline] iterateubuf include/linux/ioviter.h:29 [inline] iterateandadvance2 include/linux/ioviter.h:245 [inline] iterateandadvance include/linux/ioviter.h:271 [inline] _copytoiter+0x366/0x2520 lib/ioviter.c:185 copytoiter include/linux/uio.h:196 [inline] simplecopytoiter net/core/datagram.c:532 [inline] _skbdatagramiter+0x185/0x1000 net/core/datagram.c:420 skbcopydatagramiter+0x5c/0x200 net/core/datagram.c:546 skbcopydatagrammsg include/linux/skbuff.h:4050 [inline] netlinkrecvmsg+0x432/0x1610 net/netlink/afnetlink.c:1962 sockrecvmsgnosec net/socket.c:1046 [inline] sockrecvmsg+0x2c4/0x340 net/socket.c:1068 _sysrecvfrom+0x35a/0x5f0 net/socket.c:2242 _dosysrecvfrom net/socket.c:2260 [inline] _sesysrecvfrom net/socket.c:2256 [inline] _x64sysrecvfrom+0x126/0x1d0 net/socket.c:2256 dosyscall64+0xd5/0x1f0 entrySYSCALL64afterhwframe+0x6d/0x75
Uninit was stored to memory at: pskbexpandhead+0x30f/0x19d0 net/core/skbuff.c:2253 netlinktrim+0x2c2/0x330 net/netlink/afnetlink.c:1317 netlinkunicast+0x9f/0x1260 net/netlink/afnetlink.c:1351 nlmsgunicast include/net/netlink.h:1144 [inline] nlmsgnotify+0x21d/0x2f0 net/netlink/afnetlink.c:2610 rtnetlinksend+0x73/0x90 net/core/rtnetlink.c:741 rtnetlinkmaybesend include/linux/rtnetlink.h:17 [inline] tcfaddnotify net/sched/actapi.c:2048 [inline] tcfactionadd net/sched/actapi.c:2071 [inline] tcctlaction+0x146e/0x19d0 net/sched/actapi.c:2119 rtnetlinkrcvmsg+0x1737/0x1900 net/core/rtnetlink.c:6595 netlinkrcvskb+0x375/0x650 net/netlink/afnetlink.c:2559 rtnetlinkrcv+0x34/0x40 net/core/rtnetlink.c:6613 netlinkunicastkernel net/netlink/afnetlink.c:1335 [inline] netlinkunicast+0xf4c/0x1260 net/netlink/afnetlink.c:1361 netlinksendmsg+0x10df/0x11f0 net/netlink/afnetlink.c:1905 socksendmsgnosec net/socket.c:730 [inline] socksendmsg+0x30f/0x380 net/socket.c:745 _syssendmsg+0x877/0xb60 net/socket.c:2584 _syssendmsg+0x28d/0x3c0 net/socket.c:2638 _syssendmsg net/socket.c:2667 [inline] _dosyssendmsg net/socket.c:2676 [inline] _sesyssendmsg net/socket.c:2674 [inline] _x64syssendmsg+0x307/0x4a0 net/socket.c:2674 dosyscall64+0xd5/0x1f0 entrySYSCALL64after_hwframe+0x6d/0x75
Uninit was stored to memory at: _nlaput lib/nlattr.c:1041 [inline] nlaput+0x1c6/0x230 lib/nlattr.c:1099 tcfskbmoddump+0x23f/0xc20 net/sched/actskbmod.c:256 tcfactiondumpold net/sched/actapi.c:1191 [inline] tcfactiondump1+0x85e/0x970 net/sched/actapi.c:1227 tcfactiondump+0x1fd/0x460 net/sched/actapi.c:1251 tcagetfill+0x519/0x7a0 net/sched/actapi.c:1628 tcfaddnotifymsg net/sched/actapi.c:2023 [inline] tcfaddnotify net/sched/actapi.c:2042 [inline] tcfactionadd net/sched/actapi.c:2071 [inline] tcctlaction+0x1365/0x19d0 net/sched/actapi.c:2119 rtnetlinkrcvmsg+0x1737/0x1900 net/core/rtnetlink.c:6595 netlinkrcvskb+0x375/0x650 net/netlink/afnetli ---truncated---
{ "vanir_signatures": [ { "deprecated": false, "signature_type": "Line", "target": { "file": "net/sched/act_skbmod.c" }, "signature_version": "v1", "digest": { "line_hashes": [ "176089997715939628709975574007783167999", "47118831571699625752697167613172165465", "14248760588732426502397123589146263906", "43178777320518426095499771708726407488", "78176314481373463351386844645163226579", "53036663045868850958785179574017831833", "38881283617815423920910588569561910624", "271394834841740357566316228955650816621", "297506728261182322845335784793637996615" ], "threshold": 0.9 }, "id": "CVE-2024-35893-09362f2f", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d313eb8b77557a6d5855f42d2234bd592c7b50dd" }, { "deprecated": false, "signature_type": "Function", "target": { "file": "net/sched/act_skbmod.c", "function": "tcf_skbmod_dump" }, "signature_version": "v1", "digest": { "length": 1299.0, "function_hash": "330763204568088194931649881157516754648" }, "id": "CVE-2024-35893-2bb45298", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@55d3fe7b2b7bc354e7cbc1f7b8f98a29ccd5a366" }, { "deprecated": false, "signature_type": "Function", "target": { "file": "net/sched/act_skbmod.c", "function": "tcf_skbmod_dump" }, "signature_version": "v1", "digest": { "length": 1299.0, "function_hash": "330763204568088194931649881157516754648" }, "id": "CVE-2024-35893-3028aa1a", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f190a4aa03cbd518bd9c62a66e1233984f5fd2ec" }, { "deprecated": false, "signature_type": "Function", "target": { "file": "net/sched/act_skbmod.c", "function": "tcf_skbmod_dump" }, "signature_version": "v1", "digest": { "length": 1299.0, "function_hash": "330763204568088194931649881157516754648" }, "id": "CVE-2024-35893-472048c5", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@729ad2ac2a2cdc9f4a4bdfd40bfd276e6bc33924" }, { "deprecated": false, "signature_type": "Function", "target": { "file": "net/sched/act_skbmod.c", "function": "tcf_skbmod_dump" }, "signature_version": "v1", "digest": { "length": 1299.0, "function_hash": "330763204568088194931649881157516754648" }, "id": "CVE-2024-35893-4a9e8da1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f356eb2fb567e0931143ac1769ac802d3b3e2077" }, { "deprecated": false, "signature_type": "Line", "target": { "file": "net/sched/act_skbmod.c" }, "signature_version": "v1", "digest": { "line_hashes": [ "176089997715939628709975574007783167999", "47118831571699625752697167613172165465", "14248760588732426502397123589146263906", "43178777320518426095499771708726407488", "78176314481373463351386844645163226579", "53036663045868850958785179574017831833", "38881283617815423920910588569561910624", "271394834841740357566316228955650816621", "297506728261182322845335784793637996615" ], "threshold": 0.9 }, "id": "CVE-2024-35893-5ec7eeee", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5e45dc4408857305f4685abfd7a528a1e58b51b5" }, { "deprecated": false, "signature_type": "Function", "target": { "file": "net/sched/act_skbmod.c", "function": "tcf_skbmod_dump" }, "signature_version": "v1", "digest": { "length": 1299.0, "function_hash": "330763204568088194931649881157516754648" }, "id": "CVE-2024-35893-655fb7c9", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a097fc199ab5f4b5392c5144034c0d2148b55a14" }, { "deprecated": false, "signature_type": "Line", "target": { "file": "net/sched/act_skbmod.c" }, "signature_version": "v1", "digest": { "line_hashes": [ "176089997715939628709975574007783167999", "47118831571699625752697167613172165465", "14248760588732426502397123589146263906", "43178777320518426095499771708726407488", "78176314481373463351386844645163226579", "53036663045868850958785179574017831833", "38881283617815423920910588569561910624", "271394834841740357566316228955650816621", "297506728261182322845335784793637996615" ], "threshold": 0.9 }, "id": "CVE-2024-35893-69de5e46", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f356eb2fb567e0931143ac1769ac802d3b3e2077" }, { "deprecated": false, "signature_type": "Line", "target": { "file": "net/sched/act_skbmod.c" }, "signature_version": "v1", "digest": { "line_hashes": [ "176089997715939628709975574007783167999", "47118831571699625752697167613172165465", "14248760588732426502397123589146263906", "43178777320518426095499771708726407488", "78176314481373463351386844645163226579", "53036663045868850958785179574017831833", "38881283617815423920910588569561910624", "271394834841740357566316228955650816621", "297506728261182322845335784793637996615" ], "threshold": 0.9 }, "id": "CVE-2024-35893-86ca6be0", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a097fc199ab5f4b5392c5144034c0d2148b55a14" }, { "deprecated": false, "signature_type": "Line", "target": { "file": "net/sched/act_skbmod.c" }, "signature_version": "v1", "digest": { "line_hashes": [ "176089997715939628709975574007783167999", "47118831571699625752697167613172165465", "14248760588732426502397123589146263906", "43178777320518426095499771708726407488", "78176314481373463351386844645163226579", "53036663045868850958785179574017831833", "38881283617815423920910588569561910624", "271394834841740357566316228955650816621", "297506728261182322845335784793637996615" ], "threshold": 0.9 }, "id": "CVE-2024-35893-b2b0bae0", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@729ad2ac2a2cdc9f4a4bdfd40bfd276e6bc33924" }, { "deprecated": false, "signature_type": "Line", "target": { "file": "net/sched/act_skbmod.c" }, "signature_version": "v1", "digest": { "line_hashes": [ "176089997715939628709975574007783167999", "47118831571699625752697167613172165465", "14248760588732426502397123589146263906", "43178777320518426095499771708726407488", "78176314481373463351386844645163226579", "53036663045868850958785179574017831833", "38881283617815423920910588569561910624", "271394834841740357566316228955650816621", "297506728261182322845335784793637996615" ], "threshold": 0.9 }, "id": "CVE-2024-35893-c30a8437", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@55d3fe7b2b7bc354e7cbc1f7b8f98a29ccd5a366" }, { "deprecated": false, "signature_type": "Function", "target": { "file": "net/sched/act_skbmod.c", "function": "tcf_skbmod_dump" }, "signature_version": "v1", "digest": { "length": 1299.0, "function_hash": "330763204568088194931649881157516754648" }, "id": "CVE-2024-35893-cb03a9b8", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7bb2c7103d8c13b06a57bf997b8cdbe93cd7283c" }, { "deprecated": false, "signature_type": "Function", "target": { "file": "net/sched/act_skbmod.c", "function": "tcf_skbmod_dump" }, "signature_version": "v1", "digest": { "length": 1299.0, "function_hash": "330763204568088194931649881157516754648" }, "id": "CVE-2024-35893-decf50a6", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d313eb8b77557a6d5855f42d2234bd592c7b50dd" }, { "deprecated": false, "signature_type": "Function", "target": { "file": "net/sched/act_skbmod.c", "function": "tcf_skbmod_dump" }, "signature_version": "v1", "digest": { "length": 1299.0, "function_hash": "330763204568088194931649881157516754648" }, "id": "CVE-2024-35893-ecea0963", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5e45dc4408857305f4685abfd7a528a1e58b51b5" }, { "deprecated": false, "signature_type": "Line", "target": { "file": "net/sched/act_skbmod.c" }, "signature_version": "v1", "digest": { "line_hashes": [ "176089997715939628709975574007783167999", "47118831571699625752697167613172165465", "14248760588732426502397123589146263906", "43178777320518426095499771708726407488", "78176314481373463351386844645163226579", "53036663045868850958785179574017831833", "38881283617815423920910588569561910624", "271394834841740357566316228955650816621", "297506728261182322845335784793637996615" ], "threshold": 0.9 }, "id": "CVE-2024-35893-f073e950", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f190a4aa03cbd518bd9c62a66e1233984f5fd2ec" }, { "deprecated": false, "signature_type": "Line", "target": { "file": "net/sched/act_skbmod.c" }, "signature_version": "v1", "digest": { "line_hashes": [ "176089997715939628709975574007783167999", "47118831571699625752697167613172165465", "14248760588732426502397123589146263906", "43178777320518426095499771708726407488", "78176314481373463351386844645163226579", "53036663045868850958785179574017831833", "38881283617815423920910588569561910624", "271394834841740357566316228955650816621", "297506728261182322845335784793637996615" ], "threshold": 0.9 }, "id": "CVE-2024-35893-fca0aa25", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7bb2c7103d8c13b06a57bf997b8cdbe93cd7283c" } ] }