In the Linux kernel, the following vulnerability has been resolved:
afpacket: fix vlangetprotocoldgram() vs MSG_PEEK
Blamed commit forgot MSG_PEEK case, allowing a crash [1] as found by syzbot.
Rework vlangetprotocol_dgram() to not touch skb at all, so that it can be used from many cpus on the same skb.
Add a const qualifier to skb argument.
[1] skbuff: skbunderpanic: text:ffffffff8a8ccd05 len:29 put:14 head:ffff88807fc8e400 data:ffff88807fc8e3f4 tail:0x11 end:0x140 dev:<NULL> ------------[ cut here ]------------ kernel BUG at net/core/skbuff.c:206 ! Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI CPU: 1 UID: 0 PID: 5892 Comm: syz-executor883 Not tainted 6.13.0-rc4-syzkaller-00054-gd6ef8b40d075 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 RIP: 0010:skbpanic net/core/skbuff.c:206 [inline] RIP: 0010:skbunderpanic+0x14b/0x150 net/core/skbuff.c:216 Code: 0b 8d 48 c7 c6 86 d5 25 8e 48 8b 54 24 08 8b 0c 24 44 8b 44 24 04 4d 89 e9 50 41 54 41 57 41 56 e8 5a 69 79 f7 48 83 c4 20 90 <0f> 0b 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 RSP: 0018:ffffc900038d7638 EFLAGS: 00010282 RAX: 0000000000000087 RBX: dffffc0000000000 RCX: 609ffd18ea660600 RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000 RBP: ffff88802483c8d0 R08: ffffffff817f0a8c R09: 1ffff9200071ae60 R10: dffffc0000000000 R11: fffff5200071ae61 R12: 0000000000000140 R13: ffff88807fc8e400 R14: ffff88807fc8e3f4 R15: 0000000000000011 FS: 00007fbac5e006c0(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fbac5e00d58 CR3: 000000001238e000 CR4: 00000000003526f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> skbpush+0xe5/0x100 net/core/skbuff.c:2636 vlangetprotocoldgram+0x165/0x290 net/packet/afpacket.c:585 packetrecvmsg+0x948/0x1ef0 net/packet/afpacket.c:3552 sockrecvmsgnosec net/socket.c:1033 [inline] sockrecvmsg+0x22f/0x280 net/socket.c:1055 sysrecvmsg+0x1c6/0x480 net/socket.c:2803 sysrecvmsg net/socket.c:2845 [inline] dorecvmmsg+0x426/0xab0 net/socket.c:2940 _sysrecvmmsg net/socket.c:3014 [inline] _dosysrecvmmsg net/socket.c:3037 [inline] _sesysrecvmmsg net/socket.c:3030 [inline] _x64sysrecvmmsg+0x199/0x250 net/socket.c:3030 dosyscallx64 arch/x86/entry/common.c:52 [inline] dosyscall64+0xf3/0x230 arch/x86/entry/common.c:83 entrySYSCALL64afterhwframe+0x77/0x7f
[
{
"deprecated": false,
"target": {
"file": "include/linux/if_vlan.h"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"206060120173913794119818892428922563593",
"187514415688202026953461328506909048117",
"65006923569432223386345228801439408913",
"83943870634786534578530041756129836060",
"84262212849436029595650588455462878489",
"12141414801274393745766225803183381693",
"19759728457716363623363736304043089717",
"174885585123638139660526081904602727581",
"268435708738602588745635175910482349178",
"185276798081441615334766959884179387182",
"90673683899618780151913157225339417109",
"101646841215600973583862418953557367949"
]
},
"id": "CVE-2024-57901-00e9c778",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a693b87692b4d7c50f4fc08a996678d60534a9da",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "net/packet/af_packet.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"14002454661141323084075635095321808981",
"136289090264714234446412232356923132536",
"45186741506835393785536488987859938511",
"214094877036638509093737714127586645140",
"42984684280750361603968902369234517672",
"25990022692146900685192688967171541086",
"9467347648876850176334492769734196603",
"163406704429114841035951010115707661328",
"89744955838040391437423213860432837507",
"178416534639837258910379146903757187646",
"64902228289870162423665208889955366672",
"301787268372368626554971988778685015270",
"148597672051972825003804995901719012362",
"252448529586461680404453228168645796337",
"179879329066310150242807972321235865682",
"34681833859373808150022835564256288212"
]
},
"id": "CVE-2024-57901-018715d7",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cd8488fdc7116f6da277515647b167859d4f72b1",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "net/packet/af_packet.c",
"function": "vlan_get_protocol_dgram"
},
"digest": {
"length": 359.0,
"function_hash": "34410568853957995592520173401199550296"
},
"id": "CVE-2024-57901-03361d46",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0d3fa6c3c9ca7aa255696150f5b759ac4a4974e1",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "net/packet/af_packet.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"14002454661141323084075635095321808981",
"136289090264714234446412232356923132536",
"45186741506835393785536488987859938511",
"214094877036638509093737714127586645140",
"42984684280750361603968902369234517672",
"25990022692146900685192688967171541086",
"9467347648876850176334492769734196603",
"163406704429114841035951010115707661328",
"89744955838040391437423213860432837507",
"178416534639837258910379146903757187646",
"64902228289870162423665208889955366672",
"301787268372368626554971988778685015270",
"148597672051972825003804995901719012362",
"252448529586461680404453228168645796337",
"179879329066310150242807972321235865682",
"34681833859373808150022835564256288212"
]
},
"id": "CVE-2024-57901-09014ebd",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@de4f8d477c67ec1d7c28f3486c3e47d147d90a01",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "net/packet/af_packet.c",
"function": "vlan_get_protocol_dgram"
},
"digest": {
"length": 359.0,
"function_hash": "34410568853957995592520173401199550296"
},
"id": "CVE-2024-57901-0de32cb3",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f91a5b8089389eb408501af2762f168c3aaa7b79",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "net/packet/af_packet.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"14002454661141323084075635095321808981",
"136289090264714234446412232356923132536",
"45186741506835393785536488987859938511",
"214094877036638509093737714127586645140",
"42984684280750361603968902369234517672",
"25990022692146900685192688967171541086",
"9467347648876850176334492769734196603",
"163406704429114841035951010115707661328",
"89744955838040391437423213860432837507",
"178416534639837258910379146903757187646",
"64902228289870162423665208889955366672",
"301787268372368626554971988778685015270",
"148597672051972825003804995901719012362",
"252448529586461680404453228168645796337",
"179879329066310150242807972321235865682",
"34681833859373808150022835564256288212"
]
},
"id": "CVE-2024-57901-1adf7dec",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a693b87692b4d7c50f4fc08a996678d60534a9da",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "net/packet/af_packet.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"14002454661141323084075635095321808981",
"136289090264714234446412232356923132536",
"45186741506835393785536488987859938511",
"214094877036638509093737714127586645140",
"42984684280750361603968902369234517672",
"25990022692146900685192688967171541086",
"9467347648876850176334492769734196603",
"163406704429114841035951010115707661328",
"89744955838040391437423213860432837507",
"178416534639837258910379146903757187646",
"64902228289870162423665208889955366672",
"301787268372368626554971988778685015270",
"148597672051972825003804995901719012362",
"252448529586461680404453228168645796337",
"179879329066310150242807972321235865682",
"34681833859373808150022835564256288212"
]
},
"id": "CVE-2024-57901-3767ce0f",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f91a5b8089389eb408501af2762f168c3aaa7b79",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "include/linux/if_vlan.h",
"function": "__vlan_get_protocol"
},
"digest": {
"length": 557.0,
"function_hash": "125896446782998526009132261800218251315"
},
"id": "CVE-2024-57901-3945aa42",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0d3fa6c3c9ca7aa255696150f5b759ac4a4974e1",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "net/packet/af_packet.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"14002454661141323084075635095321808981",
"136289090264714234446412232356923132536",
"45186741506835393785536488987859938511",
"214094877036638509093737714127586645140",
"42984684280750361603968902369234517672",
"25990022692146900685192688967171541086",
"9467347648876850176334492769734196603",
"163406704429114841035951010115707661328",
"89744955838040391437423213860432837507",
"178416534639837258910379146903757187646",
"64902228289870162423665208889955366672",
"301787268372368626554971988778685015270",
"148597672051972825003804995901719012362",
"252448529586461680404453228168645796337",
"179879329066310150242807972321235865682",
"34681833859373808150022835564256288212"
]
},
"id": "CVE-2024-57901-54c7eb7a",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0d3fa6c3c9ca7aa255696150f5b759ac4a4974e1",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "include/linux/if_vlan.h",
"function": "__vlan_get_protocol"
},
"digest": {
"length": 557.0,
"function_hash": "125896446782998526009132261800218251315"
},
"id": "CVE-2024-57901-7aaa2618",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@de4f8d477c67ec1d7c28f3486c3e47d147d90a01",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "include/linux/if_vlan.h"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"206060120173913794119818892428922563593",
"187514415688202026953461328506909048117",
"65006923569432223386345228801439408913",
"83943870634786534578530041756129836060",
"84262212849436029595650588455462878489",
"12141414801274393745766225803183381693",
"19759728457716363623363736304043089717",
"174885585123638139660526081904602727581",
"268435708738602588745635175910482349178",
"185276798081441615334766959884179387182",
"90673683899618780151913157225339417109",
"101646841215600973583862418953557367949"
]
},
"id": "CVE-2024-57901-80d2f977",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@de4f8d477c67ec1d7c28f3486c3e47d147d90a01",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "include/linux/if_vlan.h",
"function": "__vlan_get_protocol"
},
"digest": {
"length": 557.0,
"function_hash": "125896446782998526009132261800218251315"
},
"id": "CVE-2024-57901-8f1c187e",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cd8488fdc7116f6da277515647b167859d4f72b1",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "net/packet/af_packet.c",
"function": "vlan_get_protocol_dgram"
},
"digest": {
"length": 359.0,
"function_hash": "34410568853957995592520173401199550296"
},
"id": "CVE-2024-57901-9c883fa5",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cd8488fdc7116f6da277515647b167859d4f72b1",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "net/packet/af_packet.c",
"function": "vlan_get_protocol_dgram"
},
"digest": {
"length": 359.0,
"function_hash": "34410568853957995592520173401199550296"
},
"id": "CVE-2024-57901-a6fe270d",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@de4f8d477c67ec1d7c28f3486c3e47d147d90a01",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "include/linux/if_vlan.h"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"206060120173913794119818892428922563593",
"187514415688202026953461328506909048117",
"65006923569432223386345228801439408913",
"83943870634786534578530041756129836060",
"84262212849436029595650588455462878489",
"12141414801274393745766225803183381693",
"19759728457716363623363736304043089717",
"174885585123638139660526081904602727581",
"268435708738602588745635175910482349178",
"185276798081441615334766959884179387182",
"90673683899618780151913157225339417109",
"101646841215600973583862418953557367949"
]
},
"id": "CVE-2024-57901-af27270a",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0d3fa6c3c9ca7aa255696150f5b759ac4a4974e1",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "include/linux/if_vlan.h"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"206060120173913794119818892428922563593",
"187514415688202026953461328506909048117",
"65006923569432223386345228801439408913",
"83943870634786534578530041756129836060",
"84262212849436029595650588455462878489",
"12141414801274393745766225803183381693",
"19759728457716363623363736304043089717",
"174885585123638139660526081904602727581",
"268435708738602588745635175910482349178",
"185276798081441615334766959884179387182",
"90673683899618780151913157225339417109",
"101646841215600973583862418953557367949"
]
},
"id": "CVE-2024-57901-b4825ede",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f91a5b8089389eb408501af2762f168c3aaa7b79",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "include/linux/if_vlan.h",
"function": "__vlan_get_protocol"
},
"digest": {
"length": 557.0,
"function_hash": "125896446782998526009132261800218251315"
},
"id": "CVE-2024-57901-d171497a",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a693b87692b4d7c50f4fc08a996678d60534a9da",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "include/linux/if_vlan.h"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"206060120173913794119818892428922563593",
"187514415688202026953461328506909048117",
"65006923569432223386345228801439408913",
"83943870634786534578530041756129836060",
"84262212849436029595650588455462878489",
"12141414801274393745766225803183381693",
"19759728457716363623363736304043089717",
"174885585123638139660526081904602727581",
"268435708738602588745635175910482349178",
"185276798081441615334766959884179387182",
"90673683899618780151913157225339417109",
"101646841215600973583862418953557367949"
]
},
"id": "CVE-2024-57901-e0c8a8c6",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cd8488fdc7116f6da277515647b167859d4f72b1",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "include/linux/if_vlan.h",
"function": "__vlan_get_protocol"
},
"digest": {
"length": 557.0,
"function_hash": "125896446782998526009132261800218251315"
},
"id": "CVE-2024-57901-ee736f87",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f91a5b8089389eb408501af2762f168c3aaa7b79",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "net/packet/af_packet.c",
"function": "vlan_get_protocol_dgram"
},
"digest": {
"length": 359.0,
"function_hash": "34410568853957995592520173401199550296"
},
"id": "CVE-2024-57901-fd9965ce",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a693b87692b4d7c50f4fc08a996678d60534a9da",
"signature_version": "v1"
}
]