In the Linux kernel, the following vulnerability has been resolved:
ipv4: Fix uninit-value access in _ipmake_skb()
KMSAN reported uninit-value access in _ipmakeskb() [1]. _ipmakeskb() tests HDRINCL to know if the skb has icmphdr. However, HDRINCL can cause a race condition. If calling setsockopt(2) with IPHDRINCL changes HDRINCL while _ipmakeskb() is running, the function will access icmphdr in the skb even if it is not included. This causes the issue reported by KMSAN.
Check FLOWIFLAGKNOWNNH on fl4->flowi4flags instead of testing HDRINCL on the socket.
Also, fl4->fl4icmptype and fl4->fl4icmpcode are not initialized. These are union in struct flowi4 and are implicitly initialized by flowi4initoutput(), but we should not rely on specific union layout.
Initialize these explicitly in raw_sendmsg().
[1] BUG: KMSAN: uninit-value in _ipmakeskb+0x2b74/0x2d20 net/ipv4/ipoutput.c:1481 _ipmakeskb+0x2b74/0x2d20 net/ipv4/ipoutput.c:1481 ipfinishskb include/net/ip.h:243 [inline] ippushpendingframes+0x4c/0x5c0 net/ipv4/ipoutput.c:1508 rawsendmsg+0x2381/0x2690 net/ipv4/raw.c:654 inetsendmsg+0x27b/0x2a0 net/ipv4/afinet.c:851 socksendmsgnosec net/socket.c:730 [inline] _socksendmsg+0x274/0x3c0 net/socket.c:745 _syssendto+0x62c/0x7b0 net/socket.c:2191 _dosyssendto net/socket.c:2203 [inline] _sesyssendto net/socket.c:2199 [inline] _x64syssendto+0x130/0x200 net/socket.c:2199 dosyscall64+0xd8/0x1f0 arch/x86/entry/common.c:83 entrySYSCALL64afterhwframe+0x6d/0x75
Uninit was created at: slabpostallochook mm/slub.c:3804 [inline] slaballocnode mm/slub.c:3845 [inline] kmemcacheallocnode+0x5f6/0xc50 mm/slub.c:3888 kmallocreserve+0x13c/0x4a0 net/core/skbuff.c:577 _allocskb+0x35a/0x7c0 net/core/skbuff.c:668 allocskb include/linux/skbuff.h:1318 [inline] _ipappenddata+0x49ab/0x68c0 net/ipv4/ipoutput.c:1128 ipappenddata+0x1e7/0x260 net/ipv4/ipoutput.c:1365 rawsendmsg+0x22b1/0x2690 net/ipv4/raw.c:648 inetsendmsg+0x27b/0x2a0 net/ipv4/afinet.c:851 socksendmsgnosec net/socket.c:730 [inline] _socksendmsg+0x274/0x3c0 net/socket.c:745 _syssendto+0x62c/0x7b0 net/socket.c:2191 _dosyssendto net/socket.c:2203 [inline] _sesyssendto net/socket.c:2199 [inline] _x64syssendto+0x130/0x200 net/socket.c:2199 dosyscall64+0xd8/0x1f0 arch/x86/entry/common.c:83 entrySYSCALL64after_hwframe+0x6d/0x75
CPU: 1 PID: 15709 Comm: syz-executor.7 Not tainted 6.8.0-11567-gb3603fcb79b1 #25 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-1.fc39 04/01/2014
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/36xxx/CVE-2024-36927.json"
}"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-36927.json"
[
{
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f5c603ad4e6fcf42f84053e882ebe20184bb309e",
"digest": {
"function_hash": "226187810187555619076594265319293367294",
"length": 3563.0
},
"id": "CVE-2024-36927-065880c7",
"deprecated": false,
"target": {
"file": "net/ipv4/raw.c",
"function": "raw_sendmsg"
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@20d3eb00ab81462d554ac6d09691b8d9aa5a5741",
"digest": {
"function_hash": "17609477538957352665666204074187011319",
"length": 2037.0
},
"id": "CVE-2024-36927-0de8bfeb",
"deprecated": false,
"target": {
"file": "net/ipv4/ip_output.c",
"function": "__ip_make_skb"
}
},
{
"signature_type": "Line",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@20d3eb00ab81462d554ac6d09691b8d9aa5a5741",
"digest": {
"line_hashes": [
"233336530581354488941870541815484058737",
"316593820192121210814012391811239413322",
"80714620046202712860729233927922315978",
"307942847375844982354106904802523953188"
],
"threshold": 0.9
},
"id": "CVE-2024-36927-2bda4d42",
"deprecated": false,
"target": {
"file": "net/ipv4/ip_output.c"
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@20d3eb00ab81462d554ac6d09691b8d9aa5a5741",
"digest": {
"function_hash": "181544335047720538450106296409141983604",
"length": 3583.0
},
"id": "CVE-2024-36927-33475c48",
"deprecated": false,
"target": {
"file": "net/ipv4/raw.c",
"function": "raw_sendmsg"
}
},
{
"signature_type": "Line",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@88c66f1879f322f11de34d37b2d3d87497afdcb6",
"digest": {
"line_hashes": [
"233336530581354488941870541815484058737",
"316593820192121210814012391811239413322",
"80714620046202712860729233927922315978",
"307942847375844982354106904802523953188"
],
"threshold": 0.9
},
"id": "CVE-2024-36927-40b89499",
"deprecated": false,
"target": {
"file": "net/ipv4/ip_output.c"
}
},
{
"signature_type": "Line",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fc1092f51567277509563800a3c56732070b6aa4",
"digest": {
"line_hashes": [
"6658039989093133642735281801954658783",
"109562569123395258655185059620553581903",
"51570235588286758110518763294963347814"
],
"threshold": 0.9
},
"id": "CVE-2024-36927-5691da30",
"deprecated": false,
"target": {
"file": "net/ipv4/raw.c"
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fc1092f51567277509563800a3c56732070b6aa4",
"digest": {
"function_hash": "112543942948445924814065609334632783618",
"length": 2085.0
},
"id": "CVE-2024-36927-5bf7254d",
"deprecated": false,
"target": {
"file": "net/ipv4/ip_output.c",
"function": "__ip_make_skb"
}
},
{
"signature_type": "Line",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@55bf541e018b76b3750cb6c6ea18c46e1ac5562e",
"digest": {
"line_hashes": [
"6658039989093133642735281801954658783",
"109562569123395258655185059620553581903",
"51570235588286758110518763294963347814"
],
"threshold": 0.9
},
"id": "CVE-2024-36927-66d1aa2d",
"deprecated": false,
"target": {
"file": "net/ipv4/raw.c"
}
},
{
"signature_type": "Line",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@55bf541e018b76b3750cb6c6ea18c46e1ac5562e",
"digest": {
"line_hashes": [
"233336530581354488941870541815484058737",
"316593820192121210814012391811239413322",
"80714620046202712860729233927922315978",
"307942847375844982354106904802523953188"
],
"threshold": 0.9
},
"id": "CVE-2024-36927-6ab9ef47",
"deprecated": false,
"target": {
"file": "net/ipv4/ip_output.c"
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5db08343ddb1b239320612036c398e4e1bb52818",
"digest": {
"function_hash": "57517569886575670458540431469063867214",
"length": 2032.0
},
"id": "CVE-2024-36927-6d15894f",
"deprecated": false,
"target": {
"file": "net/ipv4/ip_output.c",
"function": "__ip_make_skb"
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f5c603ad4e6fcf42f84053e882ebe20184bb309e",
"digest": {
"function_hash": "112543942948445924814065609334632783618",
"length": 2085.0
},
"id": "CVE-2024-36927-71b75e23",
"deprecated": false,
"target": {
"file": "net/ipv4/ip_output.c",
"function": "__ip_make_skb"
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5db08343ddb1b239320612036c398e4e1bb52818",
"digest": {
"function_hash": "231935245959335213333996604025186663849",
"length": 3559.0
},
"id": "CVE-2024-36927-86efe32c",
"deprecated": false,
"target": {
"file": "net/ipv4/raw.c",
"function": "raw_sendmsg"
}
},
{
"signature_type": "Line",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@20d3eb00ab81462d554ac6d09691b8d9aa5a5741",
"digest": {
"line_hashes": [
"6658039989093133642735281801954658783",
"109562569123395258655185059620553581903",
"51570235588286758110518763294963347814"
],
"threshold": 0.9
},
"id": "CVE-2024-36927-8776686f",
"deprecated": false,
"target": {
"file": "net/ipv4/raw.c"
}
},
{
"signature_type": "Line",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5db08343ddb1b239320612036c398e4e1bb52818",
"digest": {
"line_hashes": [
"6658039989093133642735281801954658783",
"109562569123395258655185059620553581903",
"51570235588286758110518763294963347814"
],
"threshold": 0.9
},
"id": "CVE-2024-36927-9641cb87",
"deprecated": false,
"target": {
"file": "net/ipv4/raw.c"
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@88c66f1879f322f11de34d37b2d3d87497afdcb6",
"digest": {
"function_hash": "17609477538957352665666204074187011319",
"length": 2037.0
},
"id": "CVE-2024-36927-9ddb2da2",
"deprecated": false,
"target": {
"file": "net/ipv4/ip_output.c",
"function": "__ip_make_skb"
}
},
{
"signature_type": "Line",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f5c603ad4e6fcf42f84053e882ebe20184bb309e",
"digest": {
"line_hashes": [
"264354688422925282936348223816689367212",
"182024777034758841580598044903692369911",
"50518087854486062921206584413621337749",
"16486471258349439955716333056074272817"
],
"threshold": 0.9
},
"id": "CVE-2024-36927-9e3cc2a1",
"deprecated": false,
"target": {
"file": "net/ipv4/ip_output.c"
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@88c66f1879f322f11de34d37b2d3d87497afdcb6",
"digest": {
"function_hash": "181544335047720538450106296409141983604",
"length": 3583.0
},
"id": "CVE-2024-36927-b410acbe",
"deprecated": false,
"target": {
"file": "net/ipv4/raw.c",
"function": "raw_sendmsg"
}
},
{
"signature_type": "Line",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f5c603ad4e6fcf42f84053e882ebe20184bb309e",
"digest": {
"line_hashes": [
"6658039989093133642735281801954658783",
"109562569123395258655185059620553581903",
"51570235588286758110518763294963347814"
],
"threshold": 0.9
},
"id": "CVE-2024-36927-c4152dfe",
"deprecated": false,
"target": {
"file": "net/ipv4/raw.c"
}
},
{
"signature_type": "Line",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5db08343ddb1b239320612036c398e4e1bb52818",
"digest": {
"line_hashes": [
"264354688422925282936348223816689367212",
"182024777034758841580598044903692369911",
"50518087854486062921206584413621337749",
"16486471258349439955716333056074272817"
],
"threshold": 0.9
},
"id": "CVE-2024-36927-c6b43aac",
"deprecated": false,
"target": {
"file": "net/ipv4/ip_output.c"
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@55bf541e018b76b3750cb6c6ea18c46e1ac5562e",
"digest": {
"function_hash": "92132193634442211316917977559451967355",
"length": 2033.0
},
"id": "CVE-2024-36927-d2a02b64",
"deprecated": false,
"target": {
"file": "net/ipv4/ip_output.c",
"function": "__ip_make_skb"
}
},
{
"signature_type": "Line",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fc1092f51567277509563800a3c56732070b6aa4",
"digest": {
"line_hashes": [
"264354688422925282936348223816689367212",
"182024777034758841580598044903692369911",
"50518087854486062921206584413621337749",
"16486471258349439955716333056074272817"
],
"threshold": 0.9
},
"id": "CVE-2024-36927-d544cedf",
"deprecated": false,
"target": {
"file": "net/ipv4/ip_output.c"
}
},
{
"signature_type": "Line",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@88c66f1879f322f11de34d37b2d3d87497afdcb6",
"digest": {
"line_hashes": [
"6658039989093133642735281801954658783",
"109562569123395258655185059620553581903",
"51570235588286758110518763294963347814"
],
"threshold": 0.9
},
"id": "CVE-2024-36927-d9b51f3c",
"deprecated": false,
"target": {
"file": "net/ipv4/raw.c"
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@55bf541e018b76b3750cb6c6ea18c46e1ac5562e",
"digest": {
"function_hash": "181544335047720538450106296409141983604",
"length": 3583.0
},
"id": "CVE-2024-36927-f02b71fb",
"deprecated": false,
"target": {
"file": "net/ipv4/raw.c",
"function": "raw_sendmsg"
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fc1092f51567277509563800a3c56732070b6aa4",
"digest": {
"function_hash": "226187810187555619076594265319293367294",
"length": 3563.0
},
"id": "CVE-2024-36927-ff86e695",
"deprecated": false,
"target": {
"file": "net/ipv4/raw.c",
"function": "raw_sendmsg"
}
}
]