CVE-2024-26849
Assigner: Linux
Published: 2024-04-17T10:14:20.184Z
State: PUBLISHED
descriptions: value: In the Linux kernel, the following vulnerability has been resolved:

netlink: add nla be16/32 types to minlen array

BUG: KMSAN: uninit-value in nla_validate_range_unsigned lib/nlattr.c:222 [inline]
BUG: KMSAN: uninit-value in nla_validate_int_range lib/nlattr.c:336 [inline]
BUG: KMSAN: uninit-value in validate_nla lib/nlattr.c:575 [inline]
BUG: KMSAN: uninit-value in __nla_validate_parse+0x2e20/0x45c0 lib/nlattr.c:631
 nla_validate_range_unsigned lib/nlattr.c:222 [inline]
 nla_validate_int_range lib/nlattr.c:336 [inline]
 validate_nla lib/nlattr.c:575 [inline]
...

The message in question matches this policy:

 [NFTA_TARGET_REV]       = NLA_POLICY_MAX(NLA_BE32, 255),

but because NLA_BE32 size in minlen array is 0, the validation
code will read past the malformed (too small) attribute.

Note: Other attributes, e.g. BITFIELD32, SINT, UINT.. are also missing:
those likely should be added too.
affected: product: Linux
vendor: Linux
defaultStatus: unaffected
repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
versions: version: ecaf75ffd5f5
lessThan: 0ac219c4c3ab
status: affected
versionType: git
version: ecaf75ffd5f5
lessThan: a2ab02815184
status: affected
versionType: git
version: ecaf75ffd5f5
lessThan: 7a9d14c63b35
status: affected
versionType: git
version: ecaf75ffd5f5
lessThan: 9a0d18853c28
status: affected
versionType: git
product: Linux
vendor: Linux
defaultStatus: affected
repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
versions: version: 6.1
status: affected
version: 0
lessThan: 6.1
status: unaffected
versionType: custom
version: 6.1.81
lessThanOrEqual: 6.1.*
status: unaffected
versionType: custom
version: 6.6.21
lessThanOrEqual: 6.6.*
status: unaffected
versionType: custom
version: 6.7.9
lessThanOrEqual: 6.7.*
status: unaffected
versionType: custom
version: 6.8
lessThanOrEqual: *
status: unaffected
versionType: original_commit_for_fix
title: netlink: add nla be16/32 types to minlen array
x_generator: engine: bippy-d175d3acf727