In the Linux kernel, the following vulnerability has been resolved:
net/packet: fix slab-out-of-bounds access in packet_recvmsg()
syzbot found that when an AFPACKET socket is using PACKETCOPYTHRESH and mmap operations, tpacketrcv() is queueing skbs with garbage in skb->cb[], triggering a too big copy [1]
Presumably, users of af_packet using mmap() already gets correct metadata from the mapped buffer, we can simply make sure to clear 12 bytes that might be copied to user space later.
BUG: KASAN: stack-out-of-bounds in memcpy include/linux/fortify-string.h:225 [inline] BUG: KASAN: stack-out-of-bounds in packetrecvmsg+0x56c/0x1150 net/packet/afpacket.c:3489 Write of size 165 at addr ffffc9000385fb78 by task syz-executor233/3631
CPU: 0 PID: 3631 Comm: syz-executor233 Not tainted 5.17.0-rc7-syzkaller-02396-g0b3660695e80 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: <TASK> dumpstack lib/dumpstack.c:88 [inline] dumpstacklvl+0xcd/0x134 lib/dumpstack.c:106 printaddressdescription.constprop.0.cold+0xf/0x336 mm/kasan/report.c:255 _kasanreport mm/kasan/report.c:442 [inline] kasanreport.cold+0x83/0xdf mm/kasan/report.c:459 checkregioninline mm/kasan/generic.c:183 [inline] kasancheckrange+0x13d/0x180 mm/kasan/generic.c:189 memcpy+0x39/0x60 mm/kasan/shadow.c:66 memcpy include/linux/fortify-string.h:225 [inline] packetrecvmsg+0x56c/0x1150 net/packet/afpacket.c:3489 sockrecvmsgnosec net/socket.c:948 [inline] sockrecvmsg net/socket.c:966 [inline] sockrecvmsg net/socket.c:962 [inline] sysrecvmsg+0x2c4/0x600 net/socket.c:2632 _sysrecvmsg+0x127/0x200 net/socket.c:2674 _sysrecvmsg+0xe2/0x1a0 net/socket.c:2704 dosyscallx64 arch/x86/entry/common.c:50 [inline] dosyscall64+0x35/0xb0 arch/x86/entry/common.c:80 entrySYSCALL64afterhwframe+0x44/0xae RIP: 0033:0x7fdfd5954c29 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffcf8e71e48 EFLAGS: 00000246 ORIG_RAX: 000000000000002f RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fdfd5954c29 RDX: 0000000000000000 RSI: 0000000020000500 RDI: 0000000000000005 RBP: 0000000000000000 R08: 000000000000000d R09: 000000000000000d R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffcf8e71e60 R13: 00000000000f4240 R14: 000000000000c1ff R15: 00007ffcf8e71e54 </TASK>
addr ffffc9000385fb78 is located in stack of task syz-executor233/3631 at offset 32 in frame: _sysrecvmsg+0x0/0x600 include/linux/uio.h:246
this frame has 1 object: [32, 160) 'addr'
Memory state around the buggy address: ffffc9000385fa80: 00 04 f3 f3 f3 f3 f3 00 00 00 00 00 00 00 00 00 ffffc9000385fb00: 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00
ffffc9000385fb80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f3 ^ ffffc9000385fc00: f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 f1
ffffc9000385fc80: f1 f1 f1 00 f2 f2 f2 00 f2 f2 f2 00 00 00 00 00
{ "vanir_signatures": [ { "digest": { "length": 2627.0, "function_hash": "10085738590128558342224369846247726165" }, "id": "CVE-2022-48839-039adbfe", "signature_version": "v1", "deprecated": false, "signature_type": "Function", "target": { "function": "packet_recvmsg", "file": "net/packet/af_packet.c" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ef591b35176029fdefea38e8388ffa371e18f4b2" }, { "digest": { "length": 2670.0, "function_hash": "91137559906371720645550408425341809451" }, "id": "CVE-2022-48839-0476ffb6", "signature_version": "v1", "deprecated": false, "signature_type": "Function", "target": { "function": "packet_recvmsg", "file": "net/packet/af_packet.c" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a33dd1e6693f80d805155b3f69c18c2f642915da" }, { "digest": { "length": 6366.0, "function_hash": "42145928207763101029937446914635870401" }, "id": "CVE-2022-48839-12ebc15d", "signature_version": "v1", "deprecated": false, "signature_type": "Function", "target": { "function": "tpacket_rcv", "file": "net/packet/af_packet.c" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@70b7b3c055fd4a464da8da55ff4c1f84269f9b02" }, { "digest": { "length": 2627.0, "function_hash": "10085738590128558342224369846247726165" }, "id": "CVE-2022-48839-1d979226", "signature_version": "v1", "deprecated": false, "signature_type": "Function", "target": { "function": "packet_recvmsg", "file": "net/packet/af_packet.c" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c700525fcc06b05adfea78039de02628af79e07a" }, { "digest": { "length": 6341.0, "function_hash": "56334599957888069033886297943586530303" }, "id": "CVE-2022-48839-24d66ff7", "signature_version": "v1", "deprecated": false, "signature_type": "Function", "target": { "function": "tpacket_rcv", "file": "net/packet/af_packet.c" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b1e27cda1e3c12b705875bb7e247a97168580e33" }, { "digest": { "length": 6366.0, "function_hash": "42145928207763101029937446914635870401" }, "id": "CVE-2022-48839-5e0cce75", "signature_version": "v1", "deprecated": false, "signature_type": "Function", "target": { "function": "tpacket_rcv", "file": "net/packet/af_packet.c" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c700525fcc06b05adfea78039de02628af79e07a" }, { "digest": { "length": 6366.0, "function_hash": "42145928207763101029937446914635870401" }, "id": "CVE-2022-48839-62067d26", "signature_version": "v1", "deprecated": false, "signature_type": "Function", "target": { "function": "tpacket_rcv", "file": "net/packet/af_packet.c" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a055f5f2841f7522b44a2b1eccb1951b4b03d51a" }, { "digest": { "line_hashes": [ "138431583190377446788493434534847879671", "234036406681062524471204823876269024881", "213814262563932229551929279997100096261", "29859769753861152670458079655833115432", "305993301784102839104847148881078017603", "236588108946369098086780302004263952523", "141878880782468014790607938248061407824", "323287525700179552582134215895154857044", "178932102927130874327280065919572172713", "256465952808260224860412345749027141169", "22784855730515401861725355983909936238", "21558035578951561360190407611322071359", "218282069052894587801557451229732435927" ], "threshold": 0.9 }, "id": "CVE-2022-48839-6e33aebc", "signature_version": "v1", "deprecated": false, "signature_type": "Line", "target": { "file": "net/packet/af_packet.c" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b9d5772d60f8e7ef34e290f72fc20e3a4883e7d0" }, { "digest": { "length": 2627.0, "function_hash": "10085738590128558342224369846247726165" }, "id": "CVE-2022-48839-742d1d5c", "signature_version": "v1", "deprecated": false, "signature_type": "Function", "target": { "function": "packet_recvmsg", "file": "net/packet/af_packet.c" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@70b7b3c055fd4a464da8da55ff4c1f84269f9b02" }, { "digest": { "length": 6341.0, "function_hash": "56334599957888069033886297943586530303" }, "id": "CVE-2022-48839-81847d8c", "signature_version": "v1", "deprecated": false, "signature_type": "Function", "target": { "function": "tpacket_rcv", "file": "net/packet/af_packet.c" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a33dd1e6693f80d805155b3f69c18c2f642915da" }, { "digest": { "length": 6366.0, "function_hash": "42145928207763101029937446914635870401" }, "id": "CVE-2022-48839-905e14c8", "signature_version": "v1", "deprecated": false, "signature_type": "Function", "target": { "function": "tpacket_rcv", "file": "net/packet/af_packet.c" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ef591b35176029fdefea38e8388ffa371e18f4b2" }, { "digest": { "length": 2627.0, "function_hash": "10085738590128558342224369846247726165" }, "id": "CVE-2022-48839-95ac0dbc", "signature_version": "v1", "deprecated": false, "signature_type": "Function", "target": { "function": "packet_recvmsg", "file": "net/packet/af_packet.c" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a055f5f2841f7522b44a2b1eccb1951b4b03d51a" }, { "digest": { "length": 2670.0, "function_hash": "91137559906371720645550408425341809451" }, "id": "CVE-2022-48839-990e5197", "signature_version": "v1", "deprecated": false, "signature_type": "Function", "target": { "function": "packet_recvmsg", "file": "net/packet/af_packet.c" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b1e27cda1e3c12b705875bb7e247a97168580e33" }, { "digest": { "line_hashes": [ "138431583190377446788493434534847879671", "234036406681062524471204823876269024881", "213814262563932229551929279997100096261", "29859769753861152670458079655833115432", "305993301784102839104847148881078017603", "236588108946369098086780302004263952523", "141878880782468014790607938248061407824", "323287525700179552582134215895154857044", "178932102927130874327280065919572172713", "256465952808260224860412345749027141169", "22784855730515401861725355983909936238", "21558035578951561360190407611322071359", "218282069052894587801557451229732435927" ], "threshold": 0.9 }, "id": "CVE-2022-48839-9a6e5ba1", "signature_version": "v1", "deprecated": false, "signature_type": "Line", "target": { "file": "net/packet/af_packet.c" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a055f5f2841f7522b44a2b1eccb1951b4b03d51a" }, { "digest": { "length": 2670.0, "function_hash": "91137559906371720645550408425341809451" }, "id": "CVE-2022-48839-9e7f831e", "signature_version": "v1", "deprecated": false, "signature_type": "Function", "target": { "function": "packet_recvmsg", "file": "net/packet/af_packet.c" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b9d5772d60f8e7ef34e290f72fc20e3a4883e7d0" }, { "digest": { "line_hashes": [ "138431583190377446788493434534847879671", "234036406681062524471204823876269024881", "213814262563932229551929279997100096261", "29859769753861152670458079655833115432", "305993301784102839104847148881078017603", "236588108946369098086780302004263952523", "141878880782468014790607938248061407824", "323287525700179552582134215895154857044", "178932102927130874327280065919572172713", "256465952808260224860412345749027141169", "22784855730515401861725355983909936238", "21558035578951561360190407611322071359", "218282069052894587801557451229732435927" ], "threshold": 0.9 }, "id": "CVE-2022-48839-bd30b7ff", "signature_version": "v1", "deprecated": false, "signature_type": "Line", "target": { "file": "net/packet/af_packet.c" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@268dcf1f7b3193bc446ec3d14e08a240e9561e4d" }, { "digest": { "length": 6337.0, "function_hash": "243275008636094690466376636722210437202" }, "id": "CVE-2022-48839-c3362688", "signature_version": "v1", "deprecated": false, "signature_type": "Function", "target": { "function": "tpacket_rcv", "file": "net/packet/af_packet.c" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@268dcf1f7b3193bc446ec3d14e08a240e9561e4d" }, { "digest": { "length": 2627.0, "function_hash": "10085738590128558342224369846247726165" }, "id": "CVE-2022-48839-c34e43f3", "signature_version": "v1", "deprecated": false, "signature_type": "Function", "target": { "function": "packet_recvmsg", "file": "net/packet/af_packet.c" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@268dcf1f7b3193bc446ec3d14e08a240e9561e4d" }, { "digest": { "line_hashes": [ "138431583190377446788493434534847879671", "234036406681062524471204823876269024881", "213814262563932229551929279997100096261", "29859769753861152670458079655833115432", "305993301784102839104847148881078017603", "236588108946369098086780302004263952523", "141878880782468014790607938248061407824", "323287525700179552582134215895154857044", "178932102927130874327280065919572172713", "256465952808260224860412345749027141169", "22784855730515401861725355983909936238", "21558035578951561360190407611322071359", "218282069052894587801557451229732435927" ], "threshold": 0.9 }, "id": "CVE-2022-48839-c3ffe878", "signature_version": "v1", "deprecated": false, "signature_type": "Line", "target": { "file": "net/packet/af_packet.c" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c700525fcc06b05adfea78039de02628af79e07a" }, { "digest": { "length": 5827.0, "function_hash": "9251466862194593011793799448298614335" }, "id": "CVE-2022-48839-c8831c3e", "signature_version": "v1", "deprecated": false, "signature_type": "Function", "target": { "function": "tpacket_rcv", "file": "net/packet/af_packet.c" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b9d5772d60f8e7ef34e290f72fc20e3a4883e7d0" }, { "digest": { "line_hashes": [ "138431583190377446788493434534847879671", "234036406681062524471204823876269024881", "213814262563932229551929279997100096261", "29859769753861152670458079655833115432", "305993301784102839104847148881078017603", "236588108946369098086780302004263952523", "141878880782468014790607938248061407824", "323287525700179552582134215895154857044", "178932102927130874327280065919572172713", "256465952808260224860412345749027141169", "22784855730515401861725355983909936238", "21558035578951561360190407611322071359", "218282069052894587801557451229732435927" ], "threshold": 0.9 }, "id": "CVE-2022-48839-c8bee76e", "signature_version": "v1", "deprecated": false, "signature_type": "Line", "target": { "file": "net/packet/af_packet.c" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ef591b35176029fdefea38e8388ffa371e18f4b2" }, { "digest": { "line_hashes": [ "138431583190377446788493434534847879671", "234036406681062524471204823876269024881", "213814262563932229551929279997100096261", "29859769753861152670458079655833115432", "305993301784102839104847148881078017603", "236588108946369098086780302004263952523", "141878880782468014790607938248061407824", "323287525700179552582134215895154857044", "178932102927130874327280065919572172713", "256465952808260224860412345749027141169", "22784855730515401861725355983909936238", "21558035578951561360190407611322071359", "218282069052894587801557451229732435927" ], "threshold": 0.9 }, "id": "CVE-2022-48839-de3a3966", "signature_version": "v1", "deprecated": false, "signature_type": "Line", "target": { "file": "net/packet/af_packet.c" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a33dd1e6693f80d805155b3f69c18c2f642915da" }, { "digest": { "line_hashes": [ "138431583190377446788493434534847879671", "234036406681062524471204823876269024881", "213814262563932229551929279997100096261", "29859769753861152670458079655833115432", "305993301784102839104847148881078017603", "236588108946369098086780302004263952523", "141878880782468014790607938248061407824", "323287525700179552582134215895154857044", "178932102927130874327280065919572172713", "256465952808260224860412345749027141169", "22784855730515401861725355983909936238", "21558035578951561360190407611322071359", "218282069052894587801557451229732435927" ], "threshold": 0.9 }, "id": "CVE-2022-48839-f80f0ae7", "signature_version": "v1", "deprecated": false, "signature_type": "Line", "target": { "file": "net/packet/af_packet.c" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b1e27cda1e3c12b705875bb7e247a97168580e33" }, { "digest": { "line_hashes": [ "138431583190377446788493434534847879671", "234036406681062524471204823876269024881", "213814262563932229551929279997100096261", "29859769753861152670458079655833115432", "305993301784102839104847148881078017603", "236588108946369098086780302004263952523", "141878880782468014790607938248061407824", "323287525700179552582134215895154857044", "178932102927130874327280065919572172713", "256465952808260224860412345749027141169", "22784855730515401861725355983909936238", "21558035578951561360190407611322071359", "218282069052894587801557451229732435927" ], "threshold": 0.9 }, "id": "CVE-2022-48839-ff80b3a0", "signature_version": "v1", "deprecated": false, "signature_type": "Line", "target": { "file": "net/packet/af_packet.c" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@70b7b3c055fd4a464da8da55ff4c1f84269f9b02" } ] }