In the Linux kernel, the following vulnerability has been resolved:
xfrm: validate new SA's prefixlen using SA family when sel.family is unset
This expands the validation introduced in commit 07bf7908950a ("xfrm: Validate address prefix lengths in the xfrm selector.")
syzbot created an SA with usersa.sel.family = AFUNSPEC usersa.sel.prefixlens = 128 usersa.family = AF_INET
Because of the AFUNSPEC selector, verifynewsainfo doesn't put limits on prefixlen{s,d}. But then copyfromuserstate sets x->sel.family to usersa.family (AFINET). Do the same conversion in verifynewsainfo before validating prefixlen_{s,d}, since that's how prefixlen is going to be used later on.
[
{
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "net/xfrm/xfrm_user.c",
"function": "verify_newsa_info"
},
"digest": {
"length": 2597.0,
"function_hash": "209908169942215194996828788691736031098"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@401ad99a5ae7180dd9449eac104cb755f442e7f3",
"signature_version": "v1",
"id": "CVE-2024-50142-0c124320"
},
{
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "net/xfrm/xfrm_user.c",
"function": "verify_newsa_info"
},
"digest": {
"length": 5940.0,
"function_hash": "289176448682091273796394036614155434978"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3f0ab59e6537c6a8f9e1b355b48f9c05a76e8563",
"signature_version": "v1",
"id": "CVE-2024-50142-126b2202"
},
{
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "net/xfrm/xfrm_user.c",
"function": "verify_newsa_info"
},
"digest": {
"length": 4292.0,
"function_hash": "267248692775304259718560050531741582909"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bce1afaa212ec380bf971614f70909a27882b862",
"signature_version": "v1",
"id": "CVE-2024-50142-229144a7"
},
{
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "net/xfrm/xfrm_user.c"
},
"digest": {
"line_hashes": [
"67136755323994516156607485325147481632",
"181125349684544045340525301031016644586",
"128550844696199080773385562273921721531",
"290433479311420720799565447295877592257",
"274838400158459697221854330665411673452",
"144859017704692633625670783654416282361",
"37459656705956283808678483663112058345",
"147727727366980162775608418045114513159"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f31398570acf0f0804c644006f7bfa9067106b0a",
"signature_version": "v1",
"id": "CVE-2024-50142-32ceb605"
},
{
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "net/xfrm/xfrm_user.c"
},
"digest": {
"line_hashes": [
"36093293607977561535578574676736888805",
"149703006765624352626960433919766937192",
"128550844696199080773385562273921721531",
"290433479311420720799565447295877592257",
"35733875049109673251966231366170947865",
"144859017704692633625670783654416282361",
"37459656705956283808678483663112058345",
"147727727366980162775608418045114513159"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7d9868180bd1e4cf37e7c5067362658971162366",
"signature_version": "v1",
"id": "CVE-2024-50142-3601aac6"
},
{
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "net/xfrm/xfrm_user.c"
},
"digest": {
"line_hashes": [
"36093293607977561535578574676736888805",
"149703006765624352626960433919766937192",
"128550844696199080773385562273921721531",
"290433479311420720799565447295877592257",
"35733875049109673251966231366170947865",
"144859017704692633625670783654416282361",
"37459656705956283808678483663112058345",
"147727727366980162775608418045114513159"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bce1afaa212ec380bf971614f70909a27882b862",
"signature_version": "v1",
"id": "CVE-2024-50142-4296738e"
},
{
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "net/xfrm/xfrm_user.c",
"function": "verify_newsa_info"
},
"digest": {
"length": 2597.0,
"function_hash": "209908169942215194996828788691736031098"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f31398570acf0f0804c644006f7bfa9067106b0a",
"signature_version": "v1",
"id": "CVE-2024-50142-4adfc303"
},
{
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "net/xfrm/xfrm_user.c"
},
"digest": {
"line_hashes": [
"67136755323994516156607485325147481632",
"181125349684544045340525301031016644586",
"128550844696199080773385562273921721531",
"290433479311420720799565447295877592257",
"274838400158459697221854330665411673452",
"144859017704692633625670783654416282361",
"37459656705956283808678483663112058345",
"147727727366980162775608418045114513159"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2d08a6c31c65f23db71a5385ee9cf9d8f9a67a71",
"signature_version": "v1",
"id": "CVE-2024-50142-4afb420b"
},
{
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "net/xfrm/xfrm_user.c"
},
"digest": {
"line_hashes": [
"67136755323994516156607485325147481632",
"181125349684544045340525301031016644586",
"128550844696199080773385562273921721531",
"290433479311420720799565447295877592257",
"274838400158459697221854330665411673452",
"144859017704692633625670783654416282361",
"37459656705956283808678483663112058345",
"147727727366980162775608418045114513159"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8df5cd51fd70c33aa1776e5cbcd82b0a86649d73",
"signature_version": "v1",
"id": "CVE-2024-50142-7b837f1f"
},
{
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "net/xfrm/xfrm_user.c",
"function": "verify_newsa_info"
},
"digest": {
"length": 5940.0,
"function_hash": "289176448682091273796394036614155434978"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e68dd80ba498265d2266b12dc3459164f4ff0c4a",
"signature_version": "v1",
"id": "CVE-2024-50142-9ef0bf92"
},
{
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "net/xfrm/xfrm_user.c",
"function": "verify_newsa_info"
},
"digest": {
"length": 2682.0,
"function_hash": "138528614078806644669216703376850981308"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8df5cd51fd70c33aa1776e5cbcd82b0a86649d73",
"signature_version": "v1",
"id": "CVE-2024-50142-a7b2764e"
},
{
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "net/xfrm/xfrm_user.c",
"function": "verify_newsa_info"
},
"digest": {
"length": 4292.0,
"function_hash": "267248692775304259718560050531741582909"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7d9868180bd1e4cf37e7c5067362658971162366",
"signature_version": "v1",
"id": "CVE-2024-50142-ad6197e2"
},
{
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "net/xfrm/xfrm_user.c"
},
"digest": {
"line_hashes": [
"104257347328925355752963135030863575504",
"140671410853906330738619010572003802386",
"121333332679230691555903492257146840303",
"50610914432528145254658443508897210069",
"35733875049109673251966231366170947865",
"144859017704692633625670783654416282361",
"37459656705956283808678483663112058345",
"147727727366980162775608418045114513159"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3f0ab59e6537c6a8f9e1b355b48f9c05a76e8563",
"signature_version": "v1",
"id": "CVE-2024-50142-c1ad1b0e"
},
{
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "net/xfrm/xfrm_user.c"
},
"digest": {
"line_hashes": [
"104257347328925355752963135030863575504",
"140671410853906330738619010572003802386",
"121333332679230691555903492257146840303",
"50610914432528145254658443508897210069",
"35733875049109673251966231366170947865",
"144859017704692633625670783654416282361",
"37459656705956283808678483663112058345",
"147727727366980162775608418045114513159"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e68dd80ba498265d2266b12dc3459164f4ff0c4a",
"signature_version": "v1",
"id": "CVE-2024-50142-d39670e0"
},
{
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "net/xfrm/xfrm_user.c"
},
"digest": {
"line_hashes": [
"67136755323994516156607485325147481632",
"181125349684544045340525301031016644586",
"128550844696199080773385562273921721531",
"290433479311420720799565447295877592257",
"274838400158459697221854330665411673452",
"144859017704692633625670783654416282361",
"37459656705956283808678483663112058345",
"147727727366980162775608418045114513159"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@401ad99a5ae7180dd9449eac104cb755f442e7f3",
"signature_version": "v1",
"id": "CVE-2024-50142-da4622bb"
},
{
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "net/xfrm/xfrm_user.c",
"function": "verify_newsa_info"
},
"digest": {
"length": 2682.0,
"function_hash": "138528614078806644669216703376850981308"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2d08a6c31c65f23db71a5385ee9cf9d8f9a67a71",
"signature_version": "v1",
"id": "CVE-2024-50142-f57a19c6"
}
]