geneve: fix header validation in geneve[6]_xmit_skb
In the Linux kernel, the following vulnerability has been resolved: geneve: fix header validation in geneve[6]_xmit_skb syzbot is able to trigger an uninit-value in geneve_xmit() [1] Problem : While most ip tunnel helpers (like ip_tunnel_get_dsfield()) uses skb_protocol(skb, true), pskb_inet_may_pull() is only using skb->protocol. If anything else than ETH_P_IPV6 or ETH_P_IP is found in skb->protocol, pskb_inet_may_pull() does nothing at all. If a vlan tag was provided by the caller (af_packet in the syzbot case), the network header might not point to the correct location, and skb linear part could be smaller than expected. Add skb_vlan_inet_prepare() to perform a complete mac validation. Use this in geneve for the moment, I suspect we need to adopt this more broadly. v4 - Jakub reported v3 broke l2_tos_ttl_inherit.sh selftest - Only call __vlan_get_protocol() for vlan types. v2,v3 - Addressed Sabrina comments on v1 and v2 [1] BUG: KMSAN: uninit-value in geneve_xmit_skb drivers/net/geneve.c:910 [inline] BUG: KMSAN: uninit-value in geneve_xmit+0x302d/0x5420 drivers/net/geneve.c:1030 geneve_xmit_skb drivers/net/geneve.c:910 [inline] geneve_xmit+0x302d/0x5420 drivers/net/geneve.c:1030 __netdev_start_xmit include/linux/netdevice.h:4903 [inline] netdev_start_xmit include/linux/netdevice.h:4917 [inline] xmit_one net/core/dev.c:3531 [inline] dev_hard_start_xmit+0x247/0xa20 net/core/dev.c:3547 __dev_queue_xmit+0x348d/0x52c0 net/core/dev.c:4335 dev_queue_xmit include/linux/netdevice.h
CVE-2024-35973
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2024-35973
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "35385daa8db320d2d9664930c28e732578b0d7de",
"lessThan": "43be590456e1f3566054ce78ae2dbb68cbe1a536",
"versionType": "git"
},
{
"status": "affected",
"version": "6f92124d74419797fadfbcd5b7a72c384a6413ad",
"lessThan": "d3adf11d7993518a39bd02b383cfe657ccc0023c",
"versionType": "git"
},
{
"status": "affected",
"version": "71ad9260c001b217d704cda88ecea251b2d367da",
"lessThan": "10204df9beda4978bd1d0c2db0d8375bfb03b915",
"versionType": "git"
},
{
"status": "affected",
"version": "d13f048dd40e8577260cd43faea8ec9b77520197",
"lessThan": "3c1ae6de74e3d2d6333d29a2d3e13e6094596c79",
"versionType": "git"
},
{
"status": "affected",
"version": "d13f048dd40e8577260cd43faea8ec9b77520197",
"lessThan": "4a1b65d1e55d53b397cb27014208be1e04172670",
"versionType": "git"
},
{
"status": "affected",
"version": "d13f048dd40e8577260cd43faea8ec9b77520197",
"lessThan": "190d9efa5773f26d6f334b1b8be282c4fa13fd5e",
"versionType": "git"
},
{
"status": "affected",
"version": "d13f048dd40e8577260cd43faea8ec9b77520197",
"lessThan": "357163fff3a6e48fe74745425a32071ec9caf852",
"versionType": "git"
},
{
"status": "affected",
"version": "d13f048dd40e8577260cd43faea8ec9b77520197",
"lessThan": "d8a6213d70accb403b82924a1c229e733433a5ef",
"versionType": "git"
},
{
"status": "affected",
"version": "9a51e36ebf433adf59c051bec33f5aa54640bb4d",
"versionType": "git"
},
{
"status": "affected",
"version": "21815f28af8081b258552c111774ff320cf38d38",
"versionType": "git"
},
{
"status": "affected",
"version": "4.19.191",
"lessThan": "4.19.313",
"versionType": "semver"
},
{
"status": "affected",
"version": "5.4.119",
"lessThan": "5.4.275",
"versionType": "semver"
},
{
"status": "affected",
"version": "5.10.37",
"lessThan": "5.10.216",
"versionType": "semver"
},
{
"status": "affected",
"version": "5.11.21",
"lessThan": "5.12",
"versionType": "semver"
},
{
"status": "affected",
"version": "5.12.4",
"lessThan": "5.13",
"versionType": "semver"
}
],
"programFiles": [
"drivers/net/geneve.c",
"include/net/ip_tunnels.h"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "5.13"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "5.13",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "4.19.313",
"versionType": "semver",
"lessThanOrEqual": "4.19.*"
},
{
"status": "unaffected",
"version": "5.4.275",
"versionType": "semver",
"lessThanOrEqual": "5.4.*"
},
{
"status": "unaffected",
"version": "5.10.216",
"versionType": "semver",
"lessThanOrEqual": "5.10.*"
},
{
"status": "unaffected",
"version": "5.15.156",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.87",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.28",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.8.7",
"versionType": "semver",
"lessThanOrEqual": "6.8.*"
},
{
"status": "unaffected",
"version": "6.9",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"drivers/net/geneve.c",
"include/net/ip_tunnels.h"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2024-35973
Source reference:
/cveMetadata/cveId
Publisher severity
No explicit severity was provided.
- Event
- #26562 · Revision 1
- Added to Heist Feed
- Publisher date