In the Linux kernel, the following vulnerability has been resolved:
sctp: fix kernel-infoleak for SCTP sockets
syzbot reported a kernel infoleak [1] of 4 bytes.
After analysis, it turned out r->idiagexpires is not initialized if inetsctpdiagfill() calls inetdiagmsgcommonfill()
Make sure to clear idiagtimer/idiagretrans/idiagexpires and let inetdiagmsgsctpasoc_fill() fill them again if needed.
[1]
BUG: KMSAN: kernel-infoleak in instrumentcopytouser include/linux/instrumented.h:121 [inline] BUG: KMSAN: kernel-infoleak in copyout lib/ioviter.c:154 [inline] BUG: KMSAN: kernel-infoleak in copytoiter+0x6ef/0x25a0 lib/ioviter.c:668 instrumentcopytouser include/linux/instrumented.h:121 [inline] copyout lib/ioviter.c:154 [inline] copytoiter+0x6ef/0x25a0 lib/ioviter.c:668 copytoiter include/linux/uio.h:162 [inline] simplecopytoiter+0xf3/0x140 net/core/datagram.c:519 _skbdatagramiter+0x2d5/0x11b0 net/core/datagram.c:425 skbcopydatagramiter+0xdc/0x270 net/core/datagram.c:533 skbcopydatagrammsg include/linux/skbuff.h:3696 [inline] netlinkrecvmsg+0x669/0x1c80 net/netlink/afnetlink.c:1977 sockrecvmsgnosec net/socket.c:948 [inline] sockrecvmsg net/socket.c:966 [inline] _sysrecvfrom+0x795/0xa10 net/socket.c:2097 _dosysrecvfrom net/socket.c:2115 [inline] _sesysrecvfrom net/socket.c:2111 [inline] _x64sysrecvfrom+0x19d/0x210 net/socket.c:2111 dosyscallx64 arch/x86/entry/common.c:51 [inline] dosyscall64+0x54/0xd0 arch/x86/entry/common.c:82 entrySYSCALL64afterhwframe+0x44/0xae
Uninit was created at: slabpostallochook mm/slab.h:737 [inline] slaballocnode mm/slub.c:3247 [inline] _kmallocnodetrackcaller+0xe0c/0x1510 mm/slub.c:4975 kmallocreserve net/core/skbuff.c:354 [inline] _allocskb+0x545/0xf90 net/core/skbuff.c:426 allocskb include/linux/skbuff.h:1158 [inline] netlinkdump+0x3e5/0x16c0 net/netlink/afnetlink.c:2248 _netlinkdumpstart+0xcf8/0xe90 net/netlink/afnetlink.c:2373 netlinkdumpstart include/linux/netlink.h:254 [inline] inetdiaghandlercmd+0x2e7/0x400 net/ipv4/inetdiag.c:1341 sockdiagrcvmsg+0x24a/0x620 netlinkrcvskb+0x40c/0x7e0 net/netlink/afnetlink.c:2494 sockdiagrcv+0x63/0x80 net/core/sockdiag.c:277 netlinkunicastkernel net/netlink/afnetlink.c:1317 [inline] netlinkunicast+0x1093/0x1360 net/netlink/afnetlink.c:1343 netlinksendmsg+0x14d9/0x1720 net/netlink/afnetlink.c:1919 socksendmsgnosec net/socket.c:705 [inline] socksendmsg net/socket.c:725 [inline] sockwriteiter+0x594/0x690 net/socket.c:1061 doiterreadvwritev+0xa7f/0xc70 doiterwrite+0x52c/0x1500 fs/readwrite.c:851 vfswritev fs/readwrite.c:924 [inline] dowritev+0x645/0xe00 fs/readwrite.c:967 _dosyswritev fs/readwrite.c:1040 [inline] _sesyswritev fs/readwrite.c:1037 [inline] _x64syswritev+0xe5/0x120 fs/readwrite.c:1037 dosyscallx64 arch/x86/entry/common.c:51 [inline] dosyscall64+0x54/0xd0 arch/x86/entry/common.c:82 entrySYSCALL64afterhwframe+0x44/0xae
Bytes 68-71 of 2508 are uninitialized Memory access of size 2508 starts at ffff888114f9b000 Data copied to user address 00007f7fe09ff2e0
CPU: 1 PID: 3478 Comm: syz-executor306 Not tainted 5.17.0-rc4-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
{ "vanir_signatures": [ { "signature_version": "v1", "digest": { "threshold": 0.9, "line_hashes": [ "188505125849130939682628443004680524293", "246926522297575188080531234435929773955", "187401539819524341985059518102931466555", "10408480537331344586661796516794047519", "112217203099897873973033367983993953933", "256035720270371650907692804504750334066", "103850057821916773796285484712876113319", "317252740421911646322740830171825538719", "71589566912325060689273968099370022272", "94735673762654910024972722144232529775", "54740690518947693648346578711914977010", "277064507421437015238981097852225679398", "309630426249131941479790577584173889012", "83178415998114325154974941779488946273", "62424943192002098913857480468244437208", "203734343961496984076854406052387751396", "306377696451911318842554542817499583465" ] }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2d8fa3fdf4542a2174a72d92018f488d65d848c5", "deprecated": false, "target": { "file": "net/sctp/diag.c" }, "signature_type": "Line", "id": "CVE-2022-48855-020dd1b4" }, { "signature_version": "v1", "digest": { "threshold": 0.9, "line_hashes": [ "188505125849130939682628443004680524293", "246926522297575188080531234435929773955", "187401539819524341985059518102931466555", "10408480537331344586661796516794047519", "112217203099897873973033367983993953933", "256035720270371650907692804504750334066", "103850057821916773796285484712876113319", "317252740421911646322740830171825538719", "71589566912325060689273968099370022272", "94735673762654910024972722144232529775", "54740690518947693648346578711914977010", "277064507421437015238981097852225679398", "309630426249131941479790577584173889012", "83178415998114325154974941779488946273", "62424943192002098913857480468244437208", "203734343961496984076854406052387751396", "306377696451911318842554542817499583465" ] }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@41a2864cf719c17294f417726edd411643462ab8", "deprecated": false, "target": { "file": "net/sctp/sctp_diag.c" }, "signature_type": "Line", "id": "CVE-2022-48855-02141c98" }, { "signature_version": "v1", "digest": { "length": 2406.0, "function_hash": "68106213623192125290169980440569243391" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1502f15b9f29c41883a6139f2923523873282a83", "deprecated": false, "target": { "file": "net/sctp/diag.c", "function": "inet_sctp_diag_fill" }, "signature_type": "Function", "id": "CVE-2022-48855-0870fc0d" }, { "signature_version": "v1", "digest": { "threshold": 0.9, "line_hashes": [ "188505125849130939682628443004680524293", "246926522297575188080531234435929773955", "187401539819524341985059518102931466555", "10408480537331344586661796516794047519", "112217203099897873973033367983993953933", "256035720270371650907692804504750334066", "103850057821916773796285484712876113319", "317252740421911646322740830171825538719", "71589566912325060689273968099370022272", "94735673762654910024972722144232529775", "54740690518947693648346578711914977010", "277064507421437015238981097852225679398", "309630426249131941479790577584173889012", "83178415998114325154974941779488946273", "62424943192002098913857480468244437208", "203734343961496984076854406052387751396", "306377696451911318842554542817499583465" ] }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bbf59d7ae558940cfa2b36a287fd1e88d83f89f8", "deprecated": false, "target": { "file": "net/sctp/diag.c" }, "signature_type": "Line", "id": "CVE-2022-48855-0f5321eb" }, { "signature_version": "v1", "digest": { "length": 2393.0, "function_hash": "7073604159616739718717936200359125544" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3fc0fd724d199e061432b66a8d85b7d48fe485f7", "deprecated": false, "target": { "file": "net/sctp/sctp_diag.c", "function": "inet_sctp_diag_fill" }, "signature_type": "Function", "id": "CVE-2022-48855-16fa7b0e" }, { "signature_version": "v1", "digest": { "length": 1501.0, "function_hash": "63846801850421549835630054209966866354" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b7e4d9ba2ddb78801488b4c623875b81fb46b545", "deprecated": false, "target": { "file": "net/sctp/diag.c", "function": "inet_diag_msg_sctpasoc_fill" }, "signature_type": "Function", "id": "CVE-2022-48855-60676308" }, { "signature_version": "v1", "digest": { "length": 2406.0, "function_hash": "68106213623192125290169980440569243391" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d828b0fe6631f3ae8709ac9a10c77c5836c76a08", "deprecated": false, "target": { "file": "net/sctp/diag.c", "function": "inet_sctp_diag_fill" }, "signature_type": "Function", "id": "CVE-2022-48855-65a08dcc" }, { "signature_version": "v1", "digest": { "threshold": 0.9, "line_hashes": [ "188505125849130939682628443004680524293", "246926522297575188080531234435929773955", "187401539819524341985059518102931466555", "10408480537331344586661796516794047519", "112217203099897873973033367983993953933", "256035720270371650907692804504750334066", "103850057821916773796285484712876113319", "317252740421911646322740830171825538719", "71589566912325060689273968099370022272", "94735673762654910024972722144232529775", "54740690518947693648346578711914977010", "277064507421437015238981097852225679398", "309630426249131941479790577584173889012", "83178415998114325154974941779488946273", "62424943192002098913857480468244437208", "203734343961496984076854406052387751396", "306377696451911318842554542817499583465" ] }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3fc0fd724d199e061432b66a8d85b7d48fe485f7", "deprecated": false, "target": { "file": "net/sctp/sctp_diag.c" }, "signature_type": "Line", "id": "CVE-2022-48855-706cbca2" }, { "signature_version": "v1", "digest": { "threshold": 0.9, "line_hashes": [ "188505125849130939682628443004680524293", "246926522297575188080531234435929773955", "187401539819524341985059518102931466555", "10408480537331344586661796516794047519", "112217203099897873973033367983993953933", "256035720270371650907692804504750334066", "103850057821916773796285484712876113319", "317252740421911646322740830171825538719", "71589566912325060689273968099370022272", "94735673762654910024972722144232529775", "54740690518947693648346578711914977010", "277064507421437015238981097852225679398", "309630426249131941479790577584173889012", "83178415998114325154974941779488946273", "62424943192002098913857480468244437208", "203734343961496984076854406052387751396", "306377696451911318842554542817499583465" ] }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1502f15b9f29c41883a6139f2923523873282a83", "deprecated": false, "target": { "file": "net/sctp/diag.c" }, "signature_type": "Line", "id": "CVE-2022-48855-741c42c4" }, { "signature_version": "v1", "digest": { "threshold": 0.9, "line_hashes": [ "188505125849130939682628443004680524293", "246926522297575188080531234435929773955", "187401539819524341985059518102931466555", "10408480537331344586661796516794047519", "112217203099897873973033367983993953933", "256035720270371650907692804504750334066", "103850057821916773796285484712876113319", "317252740421911646322740830171825538719", "71589566912325060689273968099370022272", "94735673762654910024972722144232529775", "54740690518947693648346578711914977010", "277064507421437015238981097852225679398", "309630426249131941479790577584173889012", "83178415998114325154974941779488946273", "62424943192002098913857480468244437208", "203734343961496984076854406052387751396", "306377696451911318842554542817499583465" ] }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@633593a808980f82d251d0ca89730d8bb8b0220c", "deprecated": false, "target": { "file": "net/sctp/diag.c" }, "signature_type": "Line", "id": "CVE-2022-48855-797ac966" }, { "signature_version": "v1", "digest": { "length": 2393.0, "function_hash": "7073604159616739718717936200359125544" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@41a2864cf719c17294f417726edd411643462ab8", "deprecated": false, "target": { "file": "net/sctp/sctp_diag.c", "function": "inet_sctp_diag_fill" }, "signature_type": "Function", "id": "CVE-2022-48855-942d8519" }, { "signature_version": "v1", "digest": { "length": 2406.0, "function_hash": "68106213623192125290169980440569243391" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bbf59d7ae558940cfa2b36a287fd1e88d83f89f8", "deprecated": false, "target": { "file": "net/sctp/diag.c", "function": "inet_sctp_diag_fill" }, "signature_type": "Function", "id": "CVE-2022-48855-9d6fd314" }, { "signature_version": "v1", "digest": { "length": 1501.0, "function_hash": "63846801850421549835630054209966866354" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@41a2864cf719c17294f417726edd411643462ab8", "deprecated": false, "target": { "file": "net/sctp/sctp_diag.c", "function": "inet_diag_msg_sctpasoc_fill" }, "signature_type": "Function", "id": "CVE-2022-48855-b53f637b" }, { "signature_version": "v1", "digest": { "length": 2406.0, "function_hash": "68106213623192125290169980440569243391" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@633593a808980f82d251d0ca89730d8bb8b0220c", "deprecated": false, "target": { "file": "net/sctp/diag.c", "function": "inet_sctp_diag_fill" }, "signature_type": "Function", "id": "CVE-2022-48855-b8200fbe" }, { "signature_version": "v1", "digest": { "length": 1501.0, "function_hash": "63846801850421549835630054209966866354" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3fc0fd724d199e061432b66a8d85b7d48fe485f7", "deprecated": false, "target": { "file": "net/sctp/sctp_diag.c", "function": "inet_diag_msg_sctpasoc_fill" }, "signature_type": "Function", "id": "CVE-2022-48855-d033039f" }, { "signature_version": "v1", "digest": { "length": 2406.0, "function_hash": "68106213623192125290169980440569243391" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b7e4d9ba2ddb78801488b4c623875b81fb46b545", "deprecated": false, "target": { "file": "net/sctp/diag.c", "function": "inet_sctp_diag_fill" }, "signature_type": "Function", "id": "CVE-2022-48855-d9539912" }, { "signature_version": "v1", "digest": { "length": 1501.0, "function_hash": "63846801850421549835630054209966866354" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bbf59d7ae558940cfa2b36a287fd1e88d83f89f8", "deprecated": false, "target": { "file": "net/sctp/diag.c", "function": "inet_diag_msg_sctpasoc_fill" }, "signature_type": "Function", "id": "CVE-2022-48855-def83123" }, { "signature_version": "v1", "digest": { "length": 2393.0, "function_hash": "7073604159616739718717936200359125544" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2d8fa3fdf4542a2174a72d92018f488d65d848c5", "deprecated": false, "target": { "file": "net/sctp/diag.c", "function": "inet_sctp_diag_fill" }, "signature_type": "Function", "id": "CVE-2022-48855-e38d1e16" }, { "signature_version": "v1", "digest": { "threshold": 0.9, "line_hashes": [ "188505125849130939682628443004680524293", "246926522297575188080531234435929773955", "187401539819524341985059518102931466555", "10408480537331344586661796516794047519", "112217203099897873973033367983993953933", "256035720270371650907692804504750334066", "103850057821916773796285484712876113319", "317252740421911646322740830171825538719", "71589566912325060689273968099370022272", "94735673762654910024972722144232529775", "54740690518947693648346578711914977010", "277064507421437015238981097852225679398", "309630426249131941479790577584173889012", "83178415998114325154974941779488946273", "62424943192002098913857480468244437208", "203734343961496984076854406052387751396", "306377696451911318842554542817499583465" ] }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d828b0fe6631f3ae8709ac9a10c77c5836c76a08", "deprecated": false, "target": { "file": "net/sctp/diag.c" }, "signature_type": "Line", "id": "CVE-2022-48855-e468ba02" }, { "signature_version": "v1", "digest": { "length": 1501.0, "function_hash": "63846801850421549835630054209966866354" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d828b0fe6631f3ae8709ac9a10c77c5836c76a08", "deprecated": false, "target": { "file": "net/sctp/diag.c", "function": "inet_diag_msg_sctpasoc_fill" }, "signature_type": "Function", "id": "CVE-2022-48855-f67dcf02" }, { "signature_version": "v1", "digest": { "length": 1501.0, "function_hash": "63846801850421549835630054209966866354" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2d8fa3fdf4542a2174a72d92018f488d65d848c5", "deprecated": false, "target": { "file": "net/sctp/diag.c", "function": "inet_diag_msg_sctpasoc_fill" }, "signature_type": "Function", "id": "CVE-2022-48855-f8acbf5d" }, { "signature_version": "v1", "digest": { "length": 1501.0, "function_hash": "63846801850421549835630054209966866354" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@633593a808980f82d251d0ca89730d8bb8b0220c", "deprecated": false, "target": { "file": "net/sctp/diag.c", "function": "inet_diag_msg_sctpasoc_fill" }, "signature_type": "Function", "id": "CVE-2022-48855-f98e8ee6" }, { "signature_version": "v1", "digest": { "threshold": 0.9, "line_hashes": [ "188505125849130939682628443004680524293", "246926522297575188080531234435929773955", "187401539819524341985059518102931466555", "10408480537331344586661796516794047519", "112217203099897873973033367983993953933", "256035720270371650907692804504750334066", "103850057821916773796285484712876113319", "317252740421911646322740830171825538719", "71589566912325060689273968099370022272", "94735673762654910024972722144232529775", "54740690518947693648346578711914977010", "277064507421437015238981097852225679398", "309630426249131941479790577584173889012", "83178415998114325154974941779488946273", "62424943192002098913857480468244437208", "203734343961496984076854406052387751396", "306377696451911318842554542817499583465" ] }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b7e4d9ba2ddb78801488b4c623875b81fb46b545", "deprecated": false, "target": { "file": "net/sctp/diag.c" }, "signature_type": "Line", "id": "CVE-2022-48855-fd082d9f" }, { "signature_version": "v1", "digest": { "length": 1501.0, "function_hash": "63846801850421549835630054209966866354" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1502f15b9f29c41883a6139f2923523873282a83", "deprecated": false, "target": { "file": "net/sctp/diag.c", "function": "inet_diag_msg_sctpasoc_fill" }, "signature_type": "Function", "id": "CVE-2022-48855-ff3e74cd" } ] }