In the Linux kernel, the following vulnerability has been resolved:
net: fix out-of-bounds access in ops_init
netallocgeneric is called by netalloc, which is called without any locking. It reads maxgenptrs, which is changed under pernetops_rwsem. It is read twice, first to allocate an array, then to set s.len, which is later used to limit the bounds of the array access.
It is possible that the array is allocated and another thread is registering a new pernet ops, increments maxgenptrs, which is then used to set s.len with a larger than allocated length for the variable array.
Fix it by reading maxgenptrs only once in netallocgeneric. If maxgenptrs is later incremented, it will be caught in netassigngeneric.
{ "vanir_signatures": [ { "signature_version": "v1", "signature_type": "Function", "target": { "file": "net/core/net_namespace.c", "function": "register_pernet_operations" }, "id": "CVE-2024-36883-0107ed97", "digest": { "length": 425.0, "function_hash": "64995110795360570476278481176832743308" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a26ff37e624d12e28077e5b24d2b264f62764ad6" }, { "signature_version": "v1", "signature_type": "Line", "target": { "file": "net/core/net_namespace.c" }, "id": "CVE-2024-36883-02894694", "digest": { "line_hashes": [ "174392573017779481850238954128402494473", "14567079540547008434300804427995981241", "56330620173937386079368373799186620680", "142383329674135563333072009232826715586", "192425837606895019227443195637721141129", "630721498399284247564870449159768881", "285972574878180180749829071648300859262", "312962580233956506248724664683049394119", "172024880134450583990380214299569257644", "150486252625465815906580968060944686599", "155929125420898559479231917311796636061", "201778512092033679919572509032055096893", "101894710425586983272772431972076441891" ], "threshold": 0.9 }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a26ff37e624d12e28077e5b24d2b264f62764ad6" }, { "signature_version": "v1", "signature_type": "Function", "target": { "file": "net/core/net_namespace.c", "function": "register_pernet_operations" }, "id": "CVE-2024-36883-0d306c6e", "digest": { "length": 425.0, "function_hash": "64995110795360570476278481176832743308" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3cdc34d76c4f777579e28ad373979d36c030cfd3" }, { "signature_version": "v1", "signature_type": "Function", "target": { "file": "net/core/net_namespace.c", "function": "register_pernet_operations" }, "id": "CVE-2024-36883-16786fd3", "digest": { "length": 425.0, "function_hash": "64995110795360570476278481176832743308" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b6dbfd5bcc267a95a0bf1bf96af46243f96ec6cd" }, { "signature_version": "v1", "signature_type": "Function", "target": { "file": "net/core/net_namespace.c", "function": "net_alloc_generic" }, "id": "CVE-2024-36883-3a0b6035", "digest": { "length": 226.0, "function_hash": "134854999922692342229890182228359389750" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a26ff37e624d12e28077e5b24d2b264f62764ad6" }, { "signature_version": "v1", "signature_type": "Function", "target": { "file": "net/core/net_namespace.c", "function": "register_pernet_operations" }, "id": "CVE-2024-36883-4650c681", "digest": { "length": 425.0, "function_hash": "64995110795360570476278481176832743308" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2d60ff5874aefd006717ca5e22ac1e25eac29c42" }, { "signature_version": "v1", "signature_type": "Line", "target": { "file": "net/core/net_namespace.c" }, "id": "CVE-2024-36883-4935fb30", "digest": { "line_hashes": [ "174392573017779481850238954128402494473", "14567079540547008434300804427995981241", "56330620173937386079368373799186620680", "142383329674135563333072009232826715586", "192425837606895019227443195637721141129", "630721498399284247564870449159768881", "285972574878180180749829071648300859262", "312962580233956506248724664683049394119", "172024880134450583990380214299569257644", "150486252625465815906580968060944686599", "155929125420898559479231917311796636061", "201778512092033679919572509032055096893", "101894710425586983272772431972076441891" ], "threshold": 0.9 }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9518b79bfd2fbf99fa9b7e8e36bcb1825e7ba030" }, { "signature_version": "v1", "signature_type": "Function", "target": { "file": "net/core/net_namespace.c", "function": "net_alloc_generic" }, "id": "CVE-2024-36883-4cdb47c8", "digest": { "length": 226.0, "function_hash": "134854999922692342229890182228359389750" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2d60ff5874aefd006717ca5e22ac1e25eac29c42" }, { "signature_version": "v1", "signature_type": "Function", "target": { "file": "net/core/net_namespace.c", "function": "net_alloc_generic" }, "id": "CVE-2024-36883-50205797", "digest": { "length": 226.0, "function_hash": "134854999922692342229890182228359389750" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3cdc34d76c4f777579e28ad373979d36c030cfd3" }, { "signature_version": "v1", "signature_type": "Function", "target": { "file": "net/core/net_namespace.c", "function": "register_pernet_operations" }, "id": "CVE-2024-36883-6183088c", "digest": { "length": 425.0, "function_hash": "64995110795360570476278481176832743308" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9518b79bfd2fbf99fa9b7e8e36bcb1825e7ba030" }, { "signature_version": "v1", "signature_type": "Line", "target": { "file": "net/core/net_namespace.c" }, "id": "CVE-2024-36883-81598602", "digest": { "line_hashes": [ "174392573017779481850238954128402494473", "14567079540547008434300804427995981241", "56330620173937386079368373799186620680", "142383329674135563333072009232826715586", "192425837606895019227443195637721141129", "630721498399284247564870449159768881", "285972574878180180749829071648300859262", "312962580233956506248724664683049394119", "172024880134450583990380214299569257644", "150486252625465815906580968060944686599", "155929125420898559479231917311796636061", "201778512092033679919572509032055096893", "101894710425586983272772431972076441891" ], "threshold": 0.9 }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b6dbfd5bcc267a95a0bf1bf96af46243f96ec6cd" }, { "signature_version": "v1", "signature_type": "Line", "target": { "file": "net/core/net_namespace.c" }, "id": "CVE-2024-36883-83ea5ecd", "digest": { "line_hashes": [ "174392573017779481850238954128402494473", "14567079540547008434300804427995981241", "56330620173937386079368373799186620680", "142383329674135563333072009232826715586", "192425837606895019227443195637721141129", "630721498399284247564870449159768881", "285972574878180180749829071648300859262", "312962580233956506248724664683049394119", "172024880134450583990380214299569257644", "150486252625465815906580968060944686599", "155929125420898559479231917311796636061", "201778512092033679919572509032055096893", "101894710425586983272772431972076441891" ], "threshold": 0.9 }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2d60ff5874aefd006717ca5e22ac1e25eac29c42" }, { "signature_version": "v1", "signature_type": "Function", "target": { "file": "net/core/net_namespace.c", "function": "register_pernet_operations" }, "id": "CVE-2024-36883-8aca8d57", "digest": { "length": 425.0, "function_hash": "64995110795360570476278481176832743308" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f4f94587e1bf87cb40ec33955a9d90148dd026ab" }, { "signature_version": "v1", "signature_type": "Function", "target": { "file": "net/core/net_namespace.c", "function": "net_alloc_generic" }, "id": "CVE-2024-36883-931fd9eb", "digest": { "length": 226.0, "function_hash": "134854999922692342229890182228359389750" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7b0e64583eab8c1d896b47e5dd0bf2e7d86ec41f" }, { "signature_version": "v1", "signature_type": "Function", "target": { "file": "net/core/net_namespace.c", "function": "net_alloc_generic" }, "id": "CVE-2024-36883-938c7cc3", "digest": { "length": 226.0, "function_hash": "134854999922692342229890182228359389750" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9518b79bfd2fbf99fa9b7e8e36bcb1825e7ba030" }, { "signature_version": "v1", "signature_type": "Line", "target": { "file": "net/core/net_namespace.c" }, "id": "CVE-2024-36883-96cddeb8", "digest": { "line_hashes": [ "237058444344628725523230841018637288663", "57510009661469274878293629477378871836", "56330620173937386079368373799186620680", "142383329674135563333072009232826715586", "192425837606895019227443195637721141129", "630721498399284247564870449159768881", "285972574878180180749829071648300859262", "312962580233956506248724664683049394119", "172024880134450583990380214299569257644", "150486252625465815906580968060944686599", "155929125420898559479231917311796636061", "201778512092033679919572509032055096893", "101894710425586983272772431972076441891" ], "threshold": 0.9 }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3cdc34d76c4f777579e28ad373979d36c030cfd3" }, { "signature_version": "v1", "signature_type": "Function", "target": { "file": "net/core/net_namespace.c", "function": "register_pernet_operations" }, "id": "CVE-2024-36883-972eb26a", "digest": { "length": 425.0, "function_hash": "64995110795360570476278481176832743308" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7b0e64583eab8c1d896b47e5dd0bf2e7d86ec41f" }, { "signature_version": "v1", "signature_type": "Function", "target": { "file": "net/core/net_namespace.c", "function": "register_pernet_operations" }, "id": "CVE-2024-36883-99f8be73", "digest": { "length": 425.0, "function_hash": "64995110795360570476278481176832743308" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0c3248bc708a7797be573214065cf908ff1f54c7" }, { "signature_version": "v1", "signature_type": "Function", "target": { "file": "net/core/net_namespace.c", "function": "net_alloc_generic" }, "id": "CVE-2024-36883-b4c701c4", "digest": { "length": 226.0, "function_hash": "134854999922692342229890182228359389750" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b6dbfd5bcc267a95a0bf1bf96af46243f96ec6cd" }, { "signature_version": "v1", "signature_type": "Line", "target": { "file": "net/core/net_namespace.c" }, "id": "CVE-2024-36883-b9228161", "digest": { "line_hashes": [ "174392573017779481850238954128402494473", "14567079540547008434300804427995981241", "56330620173937386079368373799186620680", "142383329674135563333072009232826715586", "192425837606895019227443195637721141129", "630721498399284247564870449159768881", "285972574878180180749829071648300859262", "312962580233956506248724664683049394119", "172024880134450583990380214299569257644", "150486252625465815906580968060944686599", "155929125420898559479231917311796636061", "201778512092033679919572509032055096893", "101894710425586983272772431972076441891" ], "threshold": 0.9 }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f4f94587e1bf87cb40ec33955a9d90148dd026ab" }, { "signature_version": "v1", "signature_type": "Function", "target": { "file": "net/core/net_namespace.c", "function": "net_alloc_generic" }, "id": "CVE-2024-36883-ea44ea28", "digest": { "length": 226.0, "function_hash": "134854999922692342229890182228359389750" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f4f94587e1bf87cb40ec33955a9d90148dd026ab" }, { "signature_version": "v1", "signature_type": "Line", "target": { "file": "net/core/net_namespace.c" }, "id": "CVE-2024-36883-ee329643", "digest": { "line_hashes": [ "36413444822412594106425231005742103495", "17453097204079584363369794650562491133", "56330620173937386079368373799186620680", "142383329674135563333072009232826715586", "192425837606895019227443195637721141129", "630721498399284247564870449159768881", "285972574878180180749829071648300859262", "312962580233956506248724664683049394119", "172024880134450583990380214299569257644", "150486252625465815906580968060944686599", "155929125420898559479231917311796636061", "201778512092033679919572509032055096893", "101894710425586983272772431972076441891" ], "threshold": 0.9 }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0c3248bc708a7797be573214065cf908ff1f54c7" }, { "signature_version": "v1", "signature_type": "Line", "target": { "file": "net/core/net_namespace.c" }, "id": "CVE-2024-36883-ef58dd37", "digest": { "line_hashes": [ "237058444344628725523230841018637288663", "57510009661469274878293629477378871836", "56330620173937386079368373799186620680", "142383329674135563333072009232826715586", "192425837606895019227443195637721141129", "630721498399284247564870449159768881", "285972574878180180749829071648300859262", "312962580233956506248724664683049394119", "172024880134450583990380214299569257644", "150486252625465815906580968060944686599", "155929125420898559479231917311796636061", "201778512092033679919572509032055096893", "101894710425586983272772431972076441891" ], "threshold": 0.9 }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7b0e64583eab8c1d896b47e5dd0bf2e7d86ec41f" }, { "signature_version": "v1", "signature_type": "Function", "target": { "file": "net/core/net_namespace.c", "function": "net_alloc_generic" }, "id": "CVE-2024-36883-ff9abb14", "digest": { "length": 226.0, "function_hash": "134854999922692342229890182228359389750" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0c3248bc708a7797be573214065cf908ff1f54c7" } ] }