In the Linux kernel, the following vulnerability has been resolved:
nfs: Fix KMSAN warning in decodegetfattrattrs()
Fix the following KMSAN warning:
CPU: 1 UID: 0 PID: 7651 Comm: cp Tainted: G B Tainted: [B]=BAD_PAGE
===================================================== BUG: KMSAN: uninit-value in decodegetfattrattrs+0x2d6d/0x2f90 decodegetfattrattrs+0x2d6d/0x2f90 decodegetfattrgeneric+0x806/0xb00 nfs4xdrdecgetattr+0x1de/0x240 rpcauthunwraprespdecode+0xab/0x100 rpcauthunwrapresp+0x95/0xc0 calldecode+0x4ff/0xb50 _rpcexecute+0x57b/0x19d0 rpcexecute+0x368/0x5e0 rpcruntask+0xcfe/0xee0 nfs4procgetattr+0x5b5/0x990 _nfsrevalidateinode+0x477/0xd00 nfsaccessgetcached+0x1021/0x1cc0 nfsdoaccess+0x9f/0xae0 nfspermission+0x1e4/0x8c0 inodepermission+0x356/0x6c0 linkpathwalk+0x958/0x1330 pathlookupat+0xce/0x6b0 filenamelookup+0x23e/0x770 vfsstatx+0xe7/0x970 vfsfstatat+0x1f2/0x2c0 _sesysnewfstatat+0x67/0x880 _x64sysnewfstatat+0xbd/0x120 x64syscall+0x1826/0x3cf0 dosyscall64+0xd0/0x1b0 entrySYSCALL64afterhwframe+0x77/0x7f
The KMSAN warning is triggered in decodegetfattrattrs(), when calling decodeattrmdsthreshold(). It appears that fattr->mdsthreshold is not initialized.
Fix the issue by initializing fattr->mdsthreshold to NULL in nfsfattrinit().
[
{
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "fs/nfs/inode.c",
"function": "nfs_fattr_init"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f6b2b2b981af8e7d7c62d34143acefa4e1edfe8b",
"digest": {
"length": 182.0,
"function_hash": "331293691111621280295269530036879241161"
},
"id": "CVE-2024-53066-07b2195e"
},
{
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "fs/nfs/inode.c"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8fc5ea9231af9122d227c9c13f5e578fca48d2e3",
"digest": {
"line_hashes": [
"125656030260768501492715477046842191642",
"277912230337697363009843205696463939967",
"332869455592062757080607942840302293012",
"177788458248999472118848236415375304046"
],
"threshold": 0.9
},
"id": "CVE-2024-53066-097ceb4e"
},
{
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "fs/nfs/inode.c"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f6b2b2b981af8e7d7c62d34143acefa4e1edfe8b",
"digest": {
"line_hashes": [
"125656030260768501492715477046842191642",
"277912230337697363009843205696463939967",
"332869455592062757080607942840302293012",
"177788458248999472118848236415375304046"
],
"threshold": 0.9
},
"id": "CVE-2024-53066-28f29463"
},
{
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "fs/nfs/inode.c"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f749cb60a01f8391c760a1d6ecd938cadacf9549",
"digest": {
"line_hashes": [
"125656030260768501492715477046842191642",
"277912230337697363009843205696463939967",
"332869455592062757080607942840302293012",
"177788458248999472118848236415375304046"
],
"threshold": 0.9
},
"id": "CVE-2024-53066-2d7e94be"
},
{
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "fs/nfs/inode.c",
"function": "nfs_fattr_init"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bbfcd261cc068fe1cd02a4e871275074a0daa4e2",
"digest": {
"length": 182.0,
"function_hash": "331293691111621280295269530036879241161"
},
"id": "CVE-2024-53066-3599d7ec"
},
{
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "fs/nfs/inode.c",
"function": "nfs_fattr_init"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8fc5ea9231af9122d227c9c13f5e578fca48d2e3",
"digest": {
"length": 182.0,
"function_hash": "331293691111621280295269530036879241161"
},
"id": "CVE-2024-53066-5da1f422"
},
{
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "fs/nfs/inode.c"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bbfcd261cc068fe1cd02a4e871275074a0daa4e2",
"digest": {
"line_hashes": [
"125656030260768501492715477046842191642",
"277912230337697363009843205696463939967",
"332869455592062757080607942840302293012",
"177788458248999472118848236415375304046"
],
"threshold": 0.9
},
"id": "CVE-2024-53066-617df66e"
},
{
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "fs/nfs/inode.c"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dc270d7159699ad6d11decadfce9633f0f71c1db",
"digest": {
"line_hashes": [
"125656030260768501492715477046842191642",
"277912230337697363009843205696463939967",
"332869455592062757080607942840302293012",
"177788458248999472118848236415375304046"
],
"threshold": 0.9
},
"id": "CVE-2024-53066-6b280c29"
},
{
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "fs/nfs/inode.c"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9be0a21ae52b3b822d0eec4d14e909ab394f8a92",
"digest": {
"line_hashes": [
"125656030260768501492715477046842191642",
"277912230337697363009843205696463939967",
"332869455592062757080607942840302293012",
"177788458248999472118848236415375304046"
],
"threshold": 0.9
},
"id": "CVE-2024-53066-84608123"
},
{
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "fs/nfs/inode.c",
"function": "nfs_fattr_init"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@25ffd294fef81a7f3cd9528adf21560c04d98747",
"digest": {
"length": 182.0,
"function_hash": "331293691111621280295269530036879241161"
},
"id": "CVE-2024-53066-9796b9d4"
},
{
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "fs/nfs/inode.c",
"function": "nfs_fattr_init"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9be0a21ae52b3b822d0eec4d14e909ab394f8a92",
"digest": {
"length": 182.0,
"function_hash": "331293691111621280295269530036879241161"
},
"id": "CVE-2024-53066-a0dc7785"
},
{
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "fs/nfs/inode.c",
"function": "nfs_fattr_init"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f749cb60a01f8391c760a1d6ecd938cadacf9549",
"digest": {
"length": 182.0,
"function_hash": "331293691111621280295269530036879241161"
},
"id": "CVE-2024-53066-b6df0896"
},
{
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "fs/nfs/inode.c"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@25ffd294fef81a7f3cd9528adf21560c04d98747",
"digest": {
"line_hashes": [
"125656030260768501492715477046842191642",
"277912230337697363009843205696463939967",
"332869455592062757080607942840302293012",
"177788458248999472118848236415375304046"
],
"threshold": 0.9
},
"id": "CVE-2024-53066-c203651d"
},
{
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "fs/nfs/inode.c",
"function": "nfs_fattr_init"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dc270d7159699ad6d11decadfce9633f0f71c1db",
"digest": {
"length": 182.0,
"function_hash": "331293691111621280295269530036879241161"
},
"id": "CVE-2024-53066-d0826299"
}
]