In the Linux kernel, the following vulnerability has been resolved:
net: can: j1939: Initialize unused data in j1939sendone()
syzbot reported kernel-infoleak in rawrecvmsg() [1]. j1939send_one() creates full frame including unused data, but it doesn't initialize it. This causes the kernel-infoleak issue. Fix this by initializing unused data.
[1] BUG: KMSAN: kernel-infoleak in instrumentcopytouser include/linux/instrumented.h:114 [inline] BUG: KMSAN: kernel-infoleak in copytouseriter lib/ioviter.c:24 [inline] BUG: KMSAN: kernel-infoleak in iterateubuf include/linux/ioviter.h:29 [inline] BUG: KMSAN: kernel-infoleak in iterateandadvance2 include/linux/ioviter.h:245 [inline] BUG: KMSAN: kernel-infoleak in iterateandadvance include/linux/ioviter.h:271 [inline] BUG: KMSAN: kernel-infoleak in _copytoiter+0x366/0x2520 lib/ioviter.c:185 instrumentcopytouser include/linux/instrumented.h:114 [inline] copytouseriter lib/ioviter.c:24 [inline] iterateubuf include/linux/ioviter.h:29 [inline] iterateandadvance2 include/linux/ioviter.h:245 [inline] iterateandadvance include/linux/ioviter.h:271 [inline] _copytoiter+0x366/0x2520 lib/ioviter.c:185 copytoiter include/linux/uio.h:196 [inline] memcpytomsg include/linux/skbuff.h:4113 [inline] rawrecvmsg+0x2b8/0x9e0 net/can/raw.c:1008 sockrecvmsgnosec net/socket.c:1046 [inline] sockrecvmsg+0x2c4/0x340 net/socket.c:1068 _sysrecvmsg+0x18a/0x620 net/socket.c:2803 sysrecvmsg+0x223/0x840 net/socket.c:2845 dorecvmmsg+0x4fc/0xfd0 net/socket.c:2939 _sysrecvmmsg net/socket.c:3018 [inline] _dosysrecvmmsg net/socket.c:3041 [inline] _sesysrecvmmsg net/socket.c:3034 [inline] _x64sysrecvmmsg+0x397/0x490 net/socket.c:3034 x64syscall+0xf6c/0x3b50 arch/x86/include/generated/asm/syscalls64.h:300 dosyscallx64 arch/x86/entry/common.c:52 [inline] dosyscall64+0xcf/0x1e0 arch/x86/entry/common.c:83 entrySYSCALL64after_hwframe+0x77/0x7f
Uninit was created at: slabpostallochook mm/slub.c:3804 [inline] slaballocnode mm/slub.c:3845 [inline] kmemcacheallocnode+0x613/0xc50 mm/slub.c:3888 kmallocreserve+0x13d/0x4a0 net/core/skbuff.c:577 allocskb+0x35b/0x7a0 net/core/skbuff.c:668 allocskb include/linux/skbuff.h:1313 [inline] allocskbwithfrags+0xc8/0xbf0 net/core/skbuff.c:6504 sockallocsendpskb+0xa81/0xbf0 net/core/sock.c:2795 sockallocsendskb include/net/sock.h:1842 [inline] j1939skallocskb net/can/j1939/socket.c:878 [inline] j1939sksendloop net/can/j1939/socket.c:1142 [inline] j1939sksendmsg+0xc0a/0x2730 net/can/j1939/socket.c:1277 socksendmsgnosec net/socket.c:730 [inline] _socksendmsg+0x30f/0x380 net/socket.c:745 syssendmsg+0x877/0xb60 net/socket.c:2584 _syssendmsg+0x28d/0x3c0 net/socket.c:2638 _syssendmsg net/socket.c:2667 [inline] _dosyssendmsg net/socket.c:2676 [inline] _sesyssendmsg net/socket.c:2674 [inline] _x64syssendmsg+0x307/0x4a0 net/socket.c:2674 x64syscall+0xc4b/0x3b50 arch/x86/include/generated/asm/syscalls64.h:47 dosyscallx64 arch/x86/entry/common.c:52 [inline] dosyscall64+0xcf/0x1e0 arch/x86/entry/common.c:83 entrySYSCALL64afterhwframe+0x77/0x7f
Bytes 12-15 of 16 are uninitialized Memory access of size 16 starts at ffff888120969690 Data copied to user address 00000000200017c0
CPU: 1 PID: 5050 Comm: syz-executor198 Not tainted 6.9.0-rc5-syzkaller-00031-g71b1543c83d6 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
{ "vanir_signatures": [ { "deprecated": false, "signature_type": "Line", "target": { "file": "net/can/j1939/main.c" }, "id": "CVE-2024-42076-14e4ac60", "digest": { "line_hashes": [ "46322518020178140790878775712049278920", "131783413794443288902425691463060068098", "201641835475012418151485692606718825261", "171183826859922757070300071435522458766", "27086310944467161885844475110693019145", "275426937834864667310903401105727866072", "223355654459841243103286912111923819024", "76096301591200887020835383169808623022" ], "threshold": 0.9 }, "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ab2a683938ba4416d389c2f5651cbbb2c41b779f" }, { "deprecated": false, "signature_type": "Line", "target": { "file": "net/can/j1939/main.c" }, "id": "CVE-2024-42076-245b6cf5", "digest": { "line_hashes": [ "46322518020178140790878775712049278920", "131783413794443288902425691463060068098", "201641835475012418151485692606718825261", "171183826859922757070300071435522458766", "27086310944467161885844475110693019145", "275426937834864667310903401105727866072", "223355654459841243103286912111923819024", "76096301591200887020835383169808623022" ], "threshold": 0.9 }, "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4c5dc3927e17489c1cae6f48c0d5e4acb4cae01f" }, { "deprecated": false, "signature_type": "Line", "target": { "file": "net/can/j1939/main.c" }, "id": "CVE-2024-42076-2b08f474", "digest": { "line_hashes": [ "46322518020178140790878775712049278920", "131783413794443288902425691463060068098", "201641835475012418151485692606718825261", "171183826859922757070300071435522458766", "27086310944467161885844475110693019145", "275426937834864667310903401105727866072", "223355654459841243103286912111923819024", "76096301591200887020835383169808623022" ], "threshold": 0.9 }, "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b7cdf1dd5d2a2d8200efd98d1893684db48fe134" }, { "deprecated": false, "signature_type": "Line", "target": { "file": "net/can/j1939/main.c" }, "id": "CVE-2024-42076-3b9b1db2", "digest": { "line_hashes": [ "46322518020178140790878775712049278920", "131783413794443288902425691463060068098", "201641835475012418151485692606718825261", "171183826859922757070300071435522458766", "27086310944467161885844475110693019145", "275426937834864667310903401105727866072", "223355654459841243103286912111923819024", "76096301591200887020835383169808623022" ], "threshold": 0.9 }, "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a2a0ebff7fdeb2f66e29335adf64b9e457300dd4" }, { "deprecated": false, "signature_type": "Function", "target": { "file": "net/can/j1939/main.c", "function": "j1939_send_one" }, "id": "CVE-2024-42076-518d6948", "digest": { "length": 815.0, "function_hash": "197171212078250250976665002475479770912" }, "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a2a0ebff7fdeb2f66e29335adf64b9e457300dd4" }, { "deprecated": false, "signature_type": "Function", "target": { "file": "net/can/j1939/main.c", "function": "j1939_send_one" }, "id": "CVE-2024-42076-54220849", "digest": { "length": 811.0, "function_hash": "56439420740749881954368804550722021529" }, "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ba7e5ae8208ac07d8e1eace0951a34c169a2d298" }, { "deprecated": false, "signature_type": "Function", "target": { "file": "net/can/j1939/main.c", "function": "j1939_send_one" }, "id": "CVE-2024-42076-5e8c0ceb", "digest": { "length": 811.0, "function_hash": "56439420740749881954368804550722021529" }, "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f97cbce633923588307049c4aef9feb2987e371b" }, { "deprecated": false, "signature_type": "Line", "target": { "file": "net/can/j1939/main.c" }, "id": "CVE-2024-42076-6399df92", "digest": { "line_hashes": [ "46322518020178140790878775712049278920", "131783413794443288902425691463060068098", "201641835475012418151485692606718825261", "171183826859922757070300071435522458766", "27086310944467161885844475110693019145", "275426937834864667310903401105727866072", "223355654459841243103286912111923819024", "76096301591200887020835383169808623022" ], "threshold": 0.9 }, "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5e4ed38eb17eaca42de57d500cc0f9668d2b6abf" }, { "deprecated": false, "signature_type": "Function", "target": { "file": "net/can/j1939/main.c", "function": "j1939_send_one" }, "id": "CVE-2024-42076-7c1fe5c0", "digest": { "length": 811.0, "function_hash": "56439420740749881954368804550722021529" }, "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ab2a683938ba4416d389c2f5651cbbb2c41b779f" }, { "deprecated": false, "signature_type": "Line", "target": { "file": "net/can/j1939/main.c" }, "id": "CVE-2024-42076-cc11e625", "digest": { "line_hashes": [ "46322518020178140790878775712049278920", "131783413794443288902425691463060068098", "201641835475012418151485692606718825261", "171183826859922757070300071435522458766", "27086310944467161885844475110693019145", "275426937834864667310903401105727866072", "223355654459841243103286912111923819024", "76096301591200887020835383169808623022" ], "threshold": 0.9 }, "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f97cbce633923588307049c4aef9feb2987e371b" }, { "deprecated": false, "signature_type": "Line", "target": { "file": "net/can/j1939/main.c" }, "id": "CVE-2024-42076-d01bf5f6", "digest": { "line_hashes": [ "46322518020178140790878775712049278920", "131783413794443288902425691463060068098", "201641835475012418151485692606718825261", "171183826859922757070300071435522458766", "27086310944467161885844475110693019145", "275426937834864667310903401105727866072", "223355654459841243103286912111923819024", "76096301591200887020835383169808623022" ], "threshold": 0.9 }, "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ba7e5ae8208ac07d8e1eace0951a34c169a2d298" }, { "deprecated": false, "signature_type": "Function", "target": { "file": "net/can/j1939/main.c", "function": "j1939_send_one" }, "id": "CVE-2024-42076-d4a0d3e4", "digest": { "length": 811.0, "function_hash": "56439420740749881954368804550722021529" }, "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b7cdf1dd5d2a2d8200efd98d1893684db48fe134" }, { "deprecated": false, "signature_type": "Function", "target": { "file": "net/can/j1939/main.c", "function": "j1939_send_one" }, "id": "CVE-2024-42076-d6792243", "digest": { "length": 815.0, "function_hash": "197171212078250250976665002475479770912" }, "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5e4ed38eb17eaca42de57d500cc0f9668d2b6abf" }, { "deprecated": false, "signature_type": "Function", "target": { "file": "net/can/j1939/main.c", "function": "j1939_send_one" }, "id": "CVE-2024-42076-f47d7249", "digest": { "length": 811.0, "function_hash": "56439420740749881954368804550722021529" }, "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4c5dc3927e17489c1cae6f48c0d5e4acb4cae01f" } ] }