netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put()
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put() syzbot reported that nf_reject_ip6_tcphdr_put() was possibly sending garbage on the four reserved tcp bits (th->res1) Use skb_put_zero() to clear the whole TCP header, as done in nf_reject_ip_tcphdr_put() BUG: KMSAN: uninit-value in nf_reject_ip6_tcphdr_put+0x688/0x6c0 net/ipv6/netfilter/nf_reject_ipv6.c:255 nf_reject_ip6_tcphdr_put+0x688/0x6c0 net/ipv6/netfilter/nf_reject_ipv6.c:255 nf_send_reset6+0xd84/0x15b0 net/ipv6/netfilter/nf_reject_ipv6.c:344 nft_reject_inet_eval+0x3c1/0x880 net/netfilter/nft_reject_inet.c:48 expr_call_ops_eval net/netfilter/nf_tables_core.c:240 [inline] nft_do_chain+0x438/0x22a0 net/netfilter/nf_tables_core.c:288 nft_do_chain_inet+0x41a/0x4f0 net/netfilter/nft_chain_filter.c:161 nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline] nf_hook_slow+0xf4/0x400 net/netfilter/core.c:626 nf_hook include/linux/netfilter.h:269 [inline] NF_HOOK include/linux/netfilter.h:312 [inline] ipv6_rcv+0x29b/0x390 net/ipv6/ip6_input.c:310 __netif_receive_skb_one_core net/core/dev.c:5661 [inline] __netif_receive_skb+0x1da/0xa00 net/core/dev.c:5775 process_backlog+0x4ad/0xa50 net/core/dev.c:6108 __napi_poll+0xe7/0x980 net/core/dev.c:6772 napi_poll net/core/dev.c:6841 [inline] net_rx_action+0xa5a/0x19b0 net/core/dev.c:6963 handle_softirqs+0x1ce/0x800 kernel/softirq.c:554 __do_softirq+0x14/0x1a kernel/softirq.c:588 do_softirq+0x9a/0x100 kernel/so
CVE-2024-47685
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2024-47685
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "c8d7b98bec43faaa6583c3135030be5eb4693acb",
"lessThan": "872eca64c3267dbc5836b715716fc6c03a18eda7",
"versionType": "git"
},
{
"status": "affected",
"version": "c8d7b98bec43faaa6583c3135030be5eb4693acb",
"lessThan": "7bcbc4cda777d26c88500d973fad0d497fc8a82e",
"versionType": "git"
},
{
"status": "affected",
"version": "c8d7b98bec43faaa6583c3135030be5eb4693acb",
"lessThan": "dcf48ab3ca2c55b09c8f9c8de0df01c1943bc4e5",
"versionType": "git"
},
{
"status": "affected",
"version": "c8d7b98bec43faaa6583c3135030be5eb4693acb",
"lessThan": "fbff87d682e57ddbbe82abf6d0a1a4a36a98afcd",
"versionType": "git"
},
{
"status": "affected",
"version": "c8d7b98bec43faaa6583c3135030be5eb4693acb",
"lessThan": "7ea2bcfd9bf4c3dbbf22546162226fd1c14d8ad2",
"versionType": "git"
},
{
"status": "affected",
"version": "c8d7b98bec43faaa6583c3135030be5eb4693acb",
"lessThan": "af4b8a704f26f38310655bad67fd8096293275a2",
"versionType": "git"
},
{
"status": "affected",
"version": "c8d7b98bec43faaa6583c3135030be5eb4693acb",
"lessThan": "7a7b5a27c53b55e91eecf646d1b204e73fa4af93",
"versionType": "git"
},
{
"status": "affected",
"version": "c8d7b98bec43faaa6583c3135030be5eb4693acb",
"lessThan": "10210658f827ad45061581cbfc05924b723e8922",
"versionType": "git"
},
{
"status": "affected",
"version": "c8d7b98bec43faaa6583c3135030be5eb4693acb",
"lessThan": "9c778fe48d20ef362047e3376dee56d77f8500d4",
"versionType": "git"
}
],
"programFiles": [
"net/ipv6/netfilter/nf_reject_ipv6.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "3.18"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "3.18",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "4.19.323",
"versionType": "semver",
"lessThanOrEqual": "4.19.*"
},
{
"status": "unaffected",
"version": "5.4.285",
"versionType": "semver",
"lessThanOrEqual": "5.4.*"
},
{
"status": "unaffected",
"version": "5.10.227",
"versionType": "semver",
"lessThanOrEqual": "5.10.*"
},
{
"status": "unaffected",
"version": "5.15.168",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.113",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.54",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.10.13",
"versionType": "semver",
"lessThanOrEqual": "6.10.*"
},
{
"status": "unaffected",
"version": "6.11.2",
"versionType": "semver",
"lessThanOrEqual": "6.11.*"
},
{
"status": "unaffected",
"version": "6.12",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"net/ipv6/netfilter/nf_reject_ipv6.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2024-47685
Source reference:
/cveMetadata/cveId
Publisher severity
No explicit severity was provided.
- Event
- #26724 · Revision 1
- Added to Heist Feed
- Publisher date