In the Linux kernel, the following vulnerability has been resolved:
netfilter: nfrejectipv6: fix nfrejectip6tcphdrput()
syzbot reported that nfrejectip6tcphdrput() was possibly sending garbage on the four reserved tcp bits (th->res1)
Use skbputzero() to clear the whole TCP header, as done in nfrejectiptcphdrput()
BUG: KMSAN: uninit-value in nfrejectip6tcphdrput+0x688/0x6c0 net/ipv6/netfilter/nfrejectipv6.c:255 nfrejectip6tcphdrput+0x688/0x6c0 net/ipv6/netfilter/nfrejectipv6.c:255 nfsendreset6+0xd84/0x15b0 net/ipv6/netfilter/nfrejectipv6.c:344 nftrejectineteval+0x3c1/0x880 net/netfilter/nftrejectinet.c:48 exprcallopseval net/netfilter/nftablescore.c:240 [inline] nftdochain+0x438/0x22a0 net/netfilter/nftablescore.c:288 nftdochaininet+0x41a/0x4f0 net/netfilter/nftchainfilter.c:161 nfhookentryhookfn include/linux/netfilter.h:154 [inline] nfhookslow+0xf4/0x400 net/netfilter/core.c:626 nfhook include/linux/netfilter.h:269 [inline] NFHOOK include/linux/netfilter.h:312 [inline] ipv6rcv+0x29b/0x390 net/ipv6/ip6input.c:310 _netifreceiveskbonecore net/core/dev.c:5661 [inline] _netifreceiveskb+0x1da/0xa00 net/core/dev.c:5775 processbacklog+0x4ad/0xa50 net/core/dev.c:6108 _napipoll+0xe7/0x980 net/core/dev.c:6772 napipoll net/core/dev.c:6841 [inline] netrxaction+0xa5a/0x19b0 net/core/dev.c:6963 handlesoftirqs+0x1ce/0x800 kernel/softirq.c:554 _dosoftirq+0x14/0x1a kernel/softirq.c:588 dosoftirq+0x9a/0x100 kernel/softirq.c:455 _localbhenableip+0x9f/0xb0 kernel/softirq.c:382 localbhenable include/linux/bottomhalf.h:33 [inline] rcureadunlockbh include/linux/rcupdate.h:908 [inline] _devqueuexmit+0x2692/0x5610 net/core/dev.c:4450 devqueuexmit include/linux/netdevice.h:3105 [inline] neighresolveoutput+0x9ca/0xae0 net/core/neighbour.c:1565 neighoutput include/net/neighbour.h:542 [inline] ip6finishoutput2+0x2347/0x2ba0 net/ipv6/ip6output.c:141 _ip6finishoutput net/ipv6/ip6output.c:215 [inline] ip6finishoutput+0xbb8/0x14b0 net/ipv6/ip6output.c:226 NFHOOKCOND include/linux/netfilter.h:303 [inline] ip6output+0x356/0x620 net/ipv6/ip6output.c:247 dstoutput include/net/dst.h:450 [inline] NFHOOK include/linux/netfilter.h:314 [inline] ip6xmit+0x1ba6/0x25d0 net/ipv6/ip6output.c:366 inet6cskxmit+0x442/0x530 net/ipv6/inet6connectionsock.c:135 _tcptransmitskb+0x3b07/0x4880 net/ipv4/tcpoutput.c:1466 tcptransmitskb net/ipv4/tcpoutput.c:1484 [inline] tcpconnect+0x35b6/0x7130 net/ipv4/tcpoutput.c:4143 tcpv6connect+0x1bcc/0x1e40 net/ipv6/tcpipv6.c:333 _inetstreamconnect+0x2ef/0x1730 net/ipv4/afinet.c:679 inetstreamconnect+0x6a/0xd0 net/ipv4/afinet.c:750 _sysconnectfile net/socket.c:2061 [inline] _sysconnect+0x606/0x690 net/socket.c:2078 _dosysconnect net/socket.c:2088 [inline] _sesysconnect net/socket.c:2085 [inline] _x64sysconnect+0x91/0xe0 net/socket.c:2085 x64syscall+0x27a5/0x3ba0 arch/x86/include/generated/asm/syscalls64.h:43 dosyscallx64 arch/x86/entry/common.c:52 [inline] dosyscall64+0xcd/0x1e0 arch/x86/entry/common.c:83 entrySYSCALL64afterhwframe+0x77/0x7f
Uninit was stored to memory at: nfrejectip6tcphdrput+0x60c/0x6c0 net/ipv6/netfilter/nfrejectipv6.c:249 nfsendreset6+0xd84/0x15b0 net/ipv6/netfilter/nfrejectipv6.c:344 nftrejectineteval+0x3c1/0x880 net/netfilter/nftrejectinet.c:48 exprcallopseval net/netfilter/nftablescore.c:240 [inline] nftdochain+0x438/0x22a0 net/netfilter/nftablescore.c:288 nftdochaininet+0x41a/0x4f0 net/netfilter/nftchainfilter.c:161 nfhookentryhookfn include/linux/netfilter.h:154 [inline] nfhookslow+0xf4/0x400 net/netfilter/core.c:626 nfhook include/linux/netfilter.h:269 [inline] NFHOOK include/linux/netfilter.h:312 [inline] ipv6rcv+0x29b/0x390 net/ipv6/ip6input.c:310 _netifreceiveskbone_core ---truncated---
[
{
"id": "CVE-2024-47685-1ea04ca6",
"signature_version": "v1",
"digest": {
"length": 837.0,
"function_hash": "340208102364807711295734429652959891675"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fbff87d682e57ddbbe82abf6d0a1a4a36a98afcd",
"target": {
"file": "net/ipv6/netfilter/nf_reject_ipv6.c",
"function": "nf_reject_ip6_tcphdr_put"
}
},
{
"id": "CVE-2024-47685-29ba8795",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"82293891372766318843945541481928982301",
"32592703619956257131355477748919270957",
"157793265663682156918880711118809148193",
"197757622662286868904621996764256503458",
"225789402583831448186591250821583425103",
"6390860674844362397266033214117172060",
"231175609009033060022992867908322025311",
"225721616423673064636959882080534201059",
"338800624235188583059851800008930703034",
"27236986521663634755232867408889687672",
"40794209135910331761382695857915590771",
"97415414881781209328167918839769486620",
"125375729277076060324239476172351769864",
"293841603096662645781011098640262355515",
"304146763253769885462706935560943611601",
"235235881219867448566104703598067194848",
"14408377487589358578829462470880772889",
"256906102780982563071151944360200126621",
"155400137387166992962500124410632867495",
"194083483072097130079011060955888611057",
"170337101225087441028038719852602292127",
"162007413937872107645810886702610959298",
"237461873292514755501318201599898730050",
"57112877064070971047795184543795936509",
"73793595319945106443699950002624688854"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7ea2bcfd9bf4c3dbbf22546162226fd1c14d8ad2",
"target": {
"file": "net/ipv6/netfilter/nf_reject_ipv6.c"
}
},
{
"id": "CVE-2024-47685-38a60894",
"signature_version": "v1",
"digest": {
"length": 837.0,
"function_hash": "340208102364807711295734429652959891675"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@af4b8a704f26f38310655bad67fd8096293275a2",
"target": {
"file": "net/ipv6/netfilter/nf_reject_ipv6.c",
"function": "nf_reject_ip6_tcphdr_put"
}
},
{
"id": "CVE-2024-47685-589c1033",
"signature_version": "v1",
"digest": {
"length": 837.0,
"function_hash": "340208102364807711295734429652959891675"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7a7b5a27c53b55e91eecf646d1b204e73fa4af93",
"target": {
"file": "net/ipv6/netfilter/nf_reject_ipv6.c",
"function": "nf_reject_ip6_tcphdr_put"
}
},
{
"id": "CVE-2024-47685-689c95c8",
"signature_version": "v1",
"digest": {
"length": 837.0,
"function_hash": "340208102364807711295734429652959891675"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@872eca64c3267dbc5836b715716fc6c03a18eda7",
"target": {
"file": "net/ipv6/netfilter/nf_reject_ipv6.c",
"function": "nf_reject_ip6_tcphdr_put"
}
},
{
"id": "CVE-2024-47685-750fae52",
"signature_version": "v1",
"digest": {
"length": 837.0,
"function_hash": "340208102364807711295734429652959891675"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7ea2bcfd9bf4c3dbbf22546162226fd1c14d8ad2",
"target": {
"file": "net/ipv6/netfilter/nf_reject_ipv6.c",
"function": "nf_reject_ip6_tcphdr_put"
}
},
{
"id": "CVE-2024-47685-86a157e2",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"82293891372766318843945541481928982301",
"32592703619956257131355477748919270957",
"157793265663682156918880711118809148193",
"197757622662286868904621996764256503458",
"225789402583831448186591250821583425103",
"6390860674844362397266033214117172060",
"231175609009033060022992867908322025311",
"225721616423673064636959882080534201059",
"338800624235188583059851800008930703034",
"27236986521663634755232867408889687672",
"40794209135910331761382695857915590771",
"97415414881781209328167918839769486620",
"125375729277076060324239476172351769864",
"293841603096662645781011098640262355515",
"304146763253769885462706935560943611601",
"235235881219867448566104703598067194848",
"14408377487589358578829462470880772889",
"256906102780982563071151944360200126621",
"155400137387166992962500124410632867495",
"194083483072097130079011060955888611057",
"170337101225087441028038719852602292127",
"162007413937872107645810886702610959298",
"237461873292514755501318201599898730050",
"57112877064070971047795184543795936509",
"73793595319945106443699950002624688854"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7a7b5a27c53b55e91eecf646d1b204e73fa4af93",
"target": {
"file": "net/ipv6/netfilter/nf_reject_ipv6.c"
}
},
{
"id": "CVE-2024-47685-9684c9fd",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"82293891372766318843945541481928982301",
"32592703619956257131355477748919270957",
"157793265663682156918880711118809148193",
"197757622662286868904621996764256503458",
"225789402583831448186591250821583425103",
"6390860674844362397266033214117172060",
"231175609009033060022992867908322025311",
"225721616423673064636959882080534201059",
"338800624235188583059851800008930703034",
"27236986521663634755232867408889687672",
"40794209135910331761382695857915590771",
"97415414881781209328167918839769486620",
"125375729277076060324239476172351769864",
"293841603096662645781011098640262355515",
"304146763253769885462706935560943611601",
"235235881219867448566104703598067194848",
"14408377487589358578829462470880772889",
"256906102780982563071151944360200126621",
"155400137387166992962500124410632867495",
"194083483072097130079011060955888611057",
"170337101225087441028038719852602292127",
"162007413937872107645810886702610959298",
"237461873292514755501318201599898730050",
"57112877064070971047795184543795936509",
"73793595319945106443699950002624688854"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7bcbc4cda777d26c88500d973fad0d497fc8a82e",
"target": {
"file": "net/ipv6/netfilter/nf_reject_ipv6.c"
}
},
{
"id": "CVE-2024-47685-998411fb",
"signature_version": "v1",
"digest": {
"length": 837.0,
"function_hash": "340208102364807711295734429652959891675"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dcf48ab3ca2c55b09c8f9c8de0df01c1943bc4e5",
"target": {
"file": "net/ipv6/netfilter/nf_reject_ipv6.c",
"function": "nf_reject_ip6_tcphdr_put"
}
},
{
"id": "CVE-2024-47685-9e9e35f5",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"82293891372766318843945541481928982301",
"32592703619956257131355477748919270957",
"157793265663682156918880711118809148193",
"197757622662286868904621996764256503458",
"225789402583831448186591250821583425103",
"6390860674844362397266033214117172060",
"231175609009033060022992867908322025311",
"225721616423673064636959882080534201059",
"338800624235188583059851800008930703034",
"27236986521663634755232867408889687672",
"40794209135910331761382695857915590771",
"97415414881781209328167918839769486620",
"125375729277076060324239476172351769864",
"293841603096662645781011098640262355515",
"304146763253769885462706935560943611601",
"235235881219867448566104703598067194848",
"14408377487589358578829462470880772889",
"256906102780982563071151944360200126621",
"155400137387166992962500124410632867495",
"194083483072097130079011060955888611057",
"170337101225087441028038719852602292127",
"162007413937872107645810886702610959298",
"237461873292514755501318201599898730050",
"57112877064070971047795184543795936509",
"73793595319945106443699950002624688854"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@872eca64c3267dbc5836b715716fc6c03a18eda7",
"target": {
"file": "net/ipv6/netfilter/nf_reject_ipv6.c"
}
},
{
"id": "CVE-2024-47685-b24c8970",
"signature_version": "v1",
"digest": {
"length": 837.0,
"function_hash": "340208102364807711295734429652959891675"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9c778fe48d20ef362047e3376dee56d77f8500d4",
"target": {
"file": "net/ipv6/netfilter/nf_reject_ipv6.c",
"function": "nf_reject_ip6_tcphdr_put"
}
},
{
"id": "CVE-2024-47685-b892cfad",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"82293891372766318843945541481928982301",
"32592703619956257131355477748919270957",
"157793265663682156918880711118809148193",
"197757622662286868904621996764256503458",
"225789402583831448186591250821583425103",
"6390860674844362397266033214117172060",
"231175609009033060022992867908322025311",
"225721616423673064636959882080534201059",
"338800624235188583059851800008930703034",
"27236986521663634755232867408889687672",
"40794209135910331761382695857915590771",
"97415414881781209328167918839769486620",
"125375729277076060324239476172351769864",
"293841603096662645781011098640262355515",
"304146763253769885462706935560943611601",
"235235881219867448566104703598067194848",
"14408377487589358578829462470880772889",
"256906102780982563071151944360200126621",
"155400137387166992962500124410632867495",
"194083483072097130079011060955888611057",
"170337101225087441028038719852602292127",
"162007413937872107645810886702610959298",
"237461873292514755501318201599898730050",
"57112877064070971047795184543795936509",
"73793595319945106443699950002624688854"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fbff87d682e57ddbbe82abf6d0a1a4a36a98afcd",
"target": {
"file": "net/ipv6/netfilter/nf_reject_ipv6.c"
}
},
{
"id": "CVE-2024-47685-ba0828f9",
"signature_version": "v1",
"digest": {
"length": 837.0,
"function_hash": "340208102364807711295734429652959891675"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7bcbc4cda777d26c88500d973fad0d497fc8a82e",
"target": {
"file": "net/ipv6/netfilter/nf_reject_ipv6.c",
"function": "nf_reject_ip6_tcphdr_put"
}
},
{
"id": "CVE-2024-47685-ca573102",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"82293891372766318843945541481928982301",
"32592703619956257131355477748919270957",
"157793265663682156918880711118809148193",
"197757622662286868904621996764256503458",
"225789402583831448186591250821583425103",
"6390860674844362397266033214117172060",
"231175609009033060022992867908322025311",
"225721616423673064636959882080534201059",
"338800624235188583059851800008930703034",
"27236986521663634755232867408889687672",
"40794209135910331761382695857915590771",
"97415414881781209328167918839769486620",
"125375729277076060324239476172351769864",
"293841603096662645781011098640262355515",
"304146763253769885462706935560943611601",
"235235881219867448566104703598067194848",
"14408377487589358578829462470880772889",
"256906102780982563071151944360200126621",
"155400137387166992962500124410632867495",
"194083483072097130079011060955888611057",
"170337101225087441028038719852602292127",
"162007413937872107645810886702610959298",
"237461873292514755501318201599898730050",
"57112877064070971047795184543795936509",
"73793595319945106443699950002624688854"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9c778fe48d20ef362047e3376dee56d77f8500d4",
"target": {
"file": "net/ipv6/netfilter/nf_reject_ipv6.c"
}
},
{
"id": "CVE-2024-47685-cbc321af",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"82293891372766318843945541481928982301",
"32592703619956257131355477748919270957",
"157793265663682156918880711118809148193",
"197757622662286868904621996764256503458",
"225789402583831448186591250821583425103",
"6390860674844362397266033214117172060",
"231175609009033060022992867908322025311",
"225721616423673064636959882080534201059",
"338800624235188583059851800008930703034",
"27236986521663634755232867408889687672",
"40794209135910331761382695857915590771",
"97415414881781209328167918839769486620",
"125375729277076060324239476172351769864",
"293841603096662645781011098640262355515",
"304146763253769885462706935560943611601",
"235235881219867448566104703598067194848",
"14408377487589358578829462470880772889",
"256906102780982563071151944360200126621",
"155400137387166992962500124410632867495",
"194083483072097130079011060955888611057",
"170337101225087441028038719852602292127",
"162007413937872107645810886702610959298",
"237461873292514755501318201599898730050",
"57112877064070971047795184543795936509",
"73793595319945106443699950002624688854"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@af4b8a704f26f38310655bad67fd8096293275a2",
"target": {
"file": "net/ipv6/netfilter/nf_reject_ipv6.c"
}
},
{
"id": "CVE-2024-47685-e83e7cf3",
"signature_version": "v1",
"digest": {
"length": 837.0,
"function_hash": "340208102364807711295734429652959891675"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@10210658f827ad45061581cbfc05924b723e8922",
"target": {
"file": "net/ipv6/netfilter/nf_reject_ipv6.c",
"function": "nf_reject_ip6_tcphdr_put"
}
},
{
"id": "CVE-2024-47685-f8d70c4a",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"82293891372766318843945541481928982301",
"32592703619956257131355477748919270957",
"157793265663682156918880711118809148193",
"197757622662286868904621996764256503458",
"225789402583831448186591250821583425103",
"6390860674844362397266033214117172060",
"231175609009033060022992867908322025311",
"225721616423673064636959882080534201059",
"338800624235188583059851800008930703034",
"27236986521663634755232867408889687672",
"40794209135910331761382695857915590771",
"97415414881781209328167918839769486620",
"125375729277076060324239476172351769864",
"293841603096662645781011098640262355515",
"304146763253769885462706935560943611601",
"235235881219867448566104703598067194848",
"14408377487589358578829462470880772889",
"256906102780982563071151944360200126621",
"155400137387166992962500124410632867495",
"194083483072097130079011060955888611057",
"170337101225087441028038719852602292127",
"162007413937872107645810886702610959298",
"237461873292514755501318201599898730050",
"57112877064070971047795184543795936509",
"73793595319945106443699950002624688854"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dcf48ab3ca2c55b09c8f9c8de0df01c1943bc4e5",
"target": {
"file": "net/ipv6/netfilter/nf_reject_ipv6.c"
}
},
{
"id": "CVE-2024-47685-f9055159",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"82293891372766318843945541481928982301",
"32592703619956257131355477748919270957",
"157793265663682156918880711118809148193",
"197757622662286868904621996764256503458",
"225789402583831448186591250821583425103",
"6390860674844362397266033214117172060",
"231175609009033060022992867908322025311",
"225721616423673064636959882080534201059",
"338800624235188583059851800008930703034",
"27236986521663634755232867408889687672",
"40794209135910331761382695857915590771",
"97415414881781209328167918839769486620",
"125375729277076060324239476172351769864",
"293841603096662645781011098640262355515",
"304146763253769885462706935560943611601",
"235235881219867448566104703598067194848",
"14408377487589358578829462470880772889",
"256906102780982563071151944360200126621",
"155400137387166992962500124410632867495",
"194083483072097130079011060955888611057",
"170337101225087441028038719852602292127",
"162007413937872107645810886702610959298",
"237461873292514755501318201599898730050",
"57112877064070971047795184543795936509",
"73793595319945106443699950002624688854"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@10210658f827ad45061581cbfc05924b723e8922",
"target": {
"file": "net/ipv6/netfilter/nf_reject_ipv6.c"
}
}
]