In the Linux kernel, the following vulnerability has been resolved:
ip6tunnel: fix NEXTHDRFRAGMENT handling in ip6tnlparsetlvenc_lim()
syzbot pointed out [1] that NEXTHDR_FRAGMENT handling is broken.
Reading frag_off can only be done if we pulled enough bytes to skb->head. Currently we might access garbage.
[1] BUG: KMSAN: uninit-value in ip6tnlparsetlvenclim+0x94f/0xbb0 ip6tnlparsetlvenclim+0x94f/0xbb0 ipxip6tnlxmit net/ipv6/ip6tunnel.c:1326 [inline] ip6tnlstartxmit+0xab2/0x1a70 net/ipv6/ip6tunnel.c:1432 netdevstartxmit include/linux/netdevice.h:4940 [inline] netdevstartxmit include/linux/netdevice.h:4954 [inline] xmitone net/core/dev.c:3548 [inline] devhardstartxmit+0x247/0xa10 net/core/dev.c:3564 _devqueuexmit+0x33b8/0x5130 net/core/dev.c:4349 devqueuexmit include/linux/netdevice.h:3134 [inline] neighconnectedoutput+0x569/0x660 net/core/neighbour.c:1592 neighoutput include/net/neighbour.h:542 [inline] ip6finishoutput2+0x23a9/0x2b30 net/ipv6/ip6output.c:137 ip6finishoutput+0x855/0x12b0 net/ipv6/ip6output.c:222 NFHOOKCOND include/linux/netfilter.h:303 [inline] ip6output+0x323/0x610 net/ipv6/ip6output.c:243 dstoutput include/net/dst.h:451 [inline] ip6localout+0xe9/0x140 net/ipv6/outputcore.c:155 ip6sendskb net/ipv6/ip6output.c:1952 [inline] ip6pushpendingframes+0x1f9/0x560 net/ipv6/ip6output.c:1972 rawv6pushpendingframes+0xbe8/0xdf0 net/ipv6/raw.c:582 rawv6sendmsg+0x2b66/0x2e70 net/ipv6/raw.c:920 inetsendmsg+0x105/0x190 net/ipv4/afinet.c:847 socksendmsgnosec net/socket.c:730 [inline] _socksendmsg net/socket.c:745 [inline] syssendmsg+0x9c2/0xd60 net/socket.c:2584 _syssendmsg+0x28d/0x3c0 net/socket.c:2638 _syssendmsg net/socket.c:2667 [inline] _dosyssendmsg net/socket.c:2676 [inline] _sesyssendmsg net/socket.c:2674 [inline] _x64syssendmsg+0x307/0x490 net/socket.c:2674 dosyscallx64 arch/x86/entry/common.c:52 [inline] dosyscall64+0x44/0x110 arch/x86/entry/common.c:83 entrySYSCALL64after_hwframe+0x63/0x6b
Uninit was created at: slabpostallochook+0x129/0xa70 mm/slab.h:768 slaballocnode mm/slub.c:3478 [inline] kmemcacheallocnode+0x5c9/0x970 mm/slub.c:3517 _dokmallocnode mm/slabcommon.c:1006 [inline] _kmallocnodetrackcaller+0x118/0x3c0 mm/slabcommon.c:1027 kmallocreserve+0x249/0x4a0 net/core/skbuff.c:582 pskbexpandhead+0x226/0x1a00 net/core/skbuff.c:2098 _pskbpulltail+0x13b/0x2310 net/core/skbuff.c:2655 pskbmaypullreason include/linux/skbuff.h:2673 [inline] pskbmaypull include/linux/skbuff.h:2681 [inline] ip6tnlparsetlvenclim+0x901/0xbb0 net/ipv6/ip6tunnel.c:408 ipxip6tnlxmit net/ipv6/ip6tunnel.c:1326 [inline] ip6tnlstartxmit+0xab2/0x1a70 net/ipv6/ip6tunnel.c:1432 _netdevstartxmit include/linux/netdevice.h:4940 [inline] netdevstartxmit include/linux/netdevice.h:4954 [inline] xmitone net/core/dev.c:3548 [inline] devhardstartxmit+0x247/0xa10 net/core/dev.c:3564 _devqueuexmit+0x33b8/0x5130 net/core/dev.c:4349 devqueuexmit include/linux/netdevice.h:3134 [inline] neighconnectedoutput+0x569/0x660 net/core/neighbour.c:1592 neighoutput include/net/neighbour.h:542 [inline] ip6finishoutput2+0x23a9/0x2b30 net/ipv6/ip6output.c:137 ip6finishoutput+0x855/0x12b0 net/ipv6/ip6output.c:222 NFHOOKCOND include/linux/netfilter.h:303 [inline] ip6output+0x323/0x610 net/ipv6/ip6output.c:243 dstoutput include/net/dst.h:451 [inline] ip6localout+0xe9/0x140 net/ipv6/outputcore.c:155 ip6sendskb net/ipv6/ip6output.c:1952 [inline] ip6pushpendingframes+0x1f9/0x560 net/ipv6/ip6output.c:1972 rawv6pushpendingframes+0xbe8/0xdf0 net/ipv6/raw.c:582 rawv6sendmsg+0x2b66/0x2e70 net/ipv6/raw.c:920 inetsendmsg+0x105/0x190 net/ipv4/afinet.c:847 socksendmsgnosec net/socket.c:730 [inline] _socksendmsg net/socket.c:745 [inline] _syssendmsg+0x9c2/0xd60 net/socket.c:2584 _syssendmsg+0x28d/0x3c0 net/socket.c:2638 _syssendmsg net/socket.c:2667 [inline] _dosys_sendms ---truncated---
[
{
"signature_version": "v1",
"target": {
"file": "net/ipv6/ip6_tunnel.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@687c5d52fe53e602e76826dbd4d7af412747e183",
"digest": {
"line_hashes": [
"17479113808636102784349074221892354630",
"113437625532312164668741659541734285068",
"47255054419673340447793055250007521030",
"249018800678767323720856348334693661094",
"174609972792000762953062621162389996129",
"190924744299271616391109717675882025263",
"120657202304789483355444312475366146606",
"64224517788383539547642577775434167855",
"200058370505364799336824064716375596767",
"93199813760344348469713243141929365664",
"40765889810218258615805160826261016951",
"334477554518091820564278051640908248964",
"186551076358645054442492536812268931806",
"35146067235252272748621799531397869727",
"130921735170269262072929061887106639198",
"339120608265824829925538844609886717836",
"62282132103719406671804355976588795463",
"126299510622272756307812103230860157887",
"305732378124650168471089610861504635614",
"143324446433081478681700750634937207949",
"115470068533174480898602996655885408756",
"182999174266481141641243472205725391329",
"214149802737052845778757946292790135628",
"88372601779108907628077761709261209922",
"120784767890949267834425833489434574793"
],
"threshold": 0.9
},
"deprecated": false,
"id": "CVE-2024-26633-0340e26b",
"signature_type": "Line"
},
{
"signature_version": "v1",
"target": {
"file": "net/ipv6/ip6_tunnel.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4329426cf6b8e22b798db2331c7ef1dd2a9c748d",
"digest": {
"line_hashes": [
"17479113808636102784349074221892354630",
"113437625532312164668741659541734285068",
"47255054419673340447793055250007521030",
"249018800678767323720856348334693661094",
"174609972792000762953062621162389996129",
"190924744299271616391109717675882025263",
"120657202304789483355444312475366146606",
"64224517788383539547642577775434167855",
"200058370505364799336824064716375596767",
"93199813760344348469713243141929365664",
"40765889810218258615805160826261016951",
"334477554518091820564278051640908248964",
"186551076358645054442492536812268931806",
"35146067235252272748621799531397869727",
"130921735170269262072929061887106639198",
"339120608265824829925538844609886717836",
"62282132103719406671804355976588795463",
"126299510622272756307812103230860157887",
"305732378124650168471089610861504635614",
"143324446433081478681700750634937207949",
"115470068533174480898602996655885408756",
"182999174266481141641243472205725391329",
"214149802737052845778757946292790135628",
"88372601779108907628077761709261209922",
"120784767890949267834425833489434574793"
],
"threshold": 0.9
},
"deprecated": false,
"id": "CVE-2024-26633-186cabab",
"signature_type": "Line"
},
{
"signature_version": "v1",
"target": {
"function": "ip6_tnl_parse_tlv_enc_lim",
"file": "net/ipv6/ip6_tunnel.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ba8d904c274268b18ef3dc11d3ca7b24a96cb087",
"digest": {
"length": 1036.0,
"function_hash": "114099873954175192158158945896272687193"
},
"deprecated": false,
"id": "CVE-2024-26633-3ba2840b",
"signature_type": "Function"
},
{
"signature_version": "v1",
"target": {
"file": "net/ipv6/ip6_tunnel.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ba8d904c274268b18ef3dc11d3ca7b24a96cb087",
"digest": {
"line_hashes": [
"17479113808636102784349074221892354630",
"113437625532312164668741659541734285068",
"47255054419673340447793055250007521030",
"249018800678767323720856348334693661094",
"174609972792000762953062621162389996129",
"190924744299271616391109717675882025263",
"120657202304789483355444312475366146606",
"64224517788383539547642577775434167855",
"200058370505364799336824064716375596767",
"93199813760344348469713243141929365664",
"40765889810218258615805160826261016951",
"334477554518091820564278051640908248964",
"186551076358645054442492536812268931806",
"35146067235252272748621799531397869727",
"130921735170269262072929061887106639198",
"339120608265824829925538844609886717836",
"62282132103719406671804355976588795463",
"126299510622272756307812103230860157887",
"305732378124650168471089610861504635614",
"143324446433081478681700750634937207949",
"115470068533174480898602996655885408756",
"182999174266481141641243472205725391329",
"214149802737052845778757946292790135628",
"88372601779108907628077761709261209922",
"120784767890949267834425833489434574793"
],
"threshold": 0.9
},
"deprecated": false,
"id": "CVE-2024-26633-3ee6089b",
"signature_type": "Line"
},
{
"signature_version": "v1",
"target": {
"function": "ip6_tnl_parse_tlv_enc_lim",
"file": "net/ipv6/ip6_tunnel.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@135414f300c5db995e2a2f3bf0f455de9d014aee",
"digest": {
"length": 1046.0,
"function_hash": "307266770403023359505400370640968242462"
},
"deprecated": false,
"id": "CVE-2024-26633-4d8bdfb0",
"signature_type": "Function"
},
{
"signature_version": "v1",
"target": {
"function": "ip6_tnl_parse_tlv_enc_lim",
"file": "net/ipv6/ip6_tunnel.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@62a1fedeb14c7ac0947ef33fadbabd35ed2400a2",
"digest": {
"length": 1036.0,
"function_hash": "114099873954175192158158945896272687193"
},
"deprecated": false,
"id": "CVE-2024-26633-61e8fd7d",
"signature_type": "Function"
},
{
"signature_version": "v1",
"target": {
"function": "ip6_tnl_parse_tlv_enc_lim",
"file": "net/ipv6/ip6_tunnel.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4329426cf6b8e22b798db2331c7ef1dd2a9c748d",
"digest": {
"length": 1036.0,
"function_hash": "114099873954175192158158945896272687193"
},
"deprecated": false,
"id": "CVE-2024-26633-7782fb4e",
"signature_type": "Function"
},
{
"signature_version": "v1",
"target": {
"file": "net/ipv6/ip6_tunnel.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3f15ba3dc14e6ee002ea01b4faddc3d49200377c",
"digest": {
"line_hashes": [
"17479113808636102784349074221892354630",
"113437625532312164668741659541734285068",
"47255054419673340447793055250007521030",
"249018800678767323720856348334693661094",
"174609972792000762953062621162389996129",
"190924744299271616391109717675882025263",
"120657202304789483355444312475366146606",
"64224517788383539547642577775434167855",
"200058370505364799336824064716375596767",
"93199813760344348469713243141929365664",
"40765889810218258615805160826261016951",
"334477554518091820564278051640908248964",
"186551076358645054442492536812268931806",
"35146067235252272748621799531397869727",
"130921735170269262072929061887106639198",
"339120608265824829925538844609886717836",
"62282132103719406671804355976588795463",
"126299510622272756307812103230860157887",
"305732378124650168471089610861504635614",
"143324446433081478681700750634937207949",
"115470068533174480898602996655885408756",
"182999174266481141641243472205725391329",
"214149802737052845778757946292790135628",
"88372601779108907628077761709261209922",
"120784767890949267834425833489434574793"
],
"threshold": 0.9
},
"deprecated": false,
"id": "CVE-2024-26633-7e4031e3",
"signature_type": "Line"
},
{
"signature_version": "v1",
"target": {
"function": "ip6_tnl_parse_tlv_enc_lim",
"file": "net/ipv6/ip6_tunnel.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@687c5d52fe53e602e76826dbd4d7af412747e183",
"digest": {
"length": 1036.0,
"function_hash": "114099873954175192158158945896272687193"
},
"deprecated": false,
"id": "CVE-2024-26633-a0cd9257",
"signature_type": "Function"
},
{
"signature_version": "v1",
"target": {
"function": "ip6_tnl_parse_tlv_enc_lim",
"file": "net/ipv6/ip6_tunnel.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3f15ba3dc14e6ee002ea01b4faddc3d49200377c",
"digest": {
"length": 1036.0,
"function_hash": "114099873954175192158158945896272687193"
},
"deprecated": false,
"id": "CVE-2024-26633-b81f90c1",
"signature_type": "Function"
},
{
"signature_version": "v1",
"target": {
"function": "ip6_tnl_parse_tlv_enc_lim",
"file": "net/ipv6/ip6_tunnel.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@da23bd709b46168f7dfc36055801011222b076cd",
"digest": {
"length": 1036.0,
"function_hash": "114099873954175192158158945896272687193"
},
"deprecated": false,
"id": "CVE-2024-26633-c4f35646",
"signature_type": "Function"
},
{
"signature_version": "v1",
"target": {
"file": "net/ipv6/ip6_tunnel.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@62a1fedeb14c7ac0947ef33fadbabd35ed2400a2",
"digest": {
"line_hashes": [
"17479113808636102784349074221892354630",
"113437625532312164668741659541734285068",
"47255054419673340447793055250007521030",
"249018800678767323720856348334693661094",
"174609972792000762953062621162389996129",
"190924744299271616391109717675882025263",
"120657202304789483355444312475366146606",
"64224517788383539547642577775434167855",
"200058370505364799336824064716375596767",
"93199813760344348469713243141929365664",
"40765889810218258615805160826261016951",
"334477554518091820564278051640908248964",
"186551076358645054442492536812268931806",
"35146067235252272748621799531397869727",
"130921735170269262072929061887106639198",
"339120608265824829925538844609886717836",
"62282132103719406671804355976588795463",
"126299510622272756307812103230860157887",
"305732378124650168471089610861504635614",
"143324446433081478681700750634937207949",
"115470068533174480898602996655885408756",
"182999174266481141641243472205725391329",
"214149802737052845778757946292790135628",
"88372601779108907628077761709261209922",
"120784767890949267834425833489434574793"
],
"threshold": 0.9
},
"deprecated": false,
"id": "CVE-2024-26633-d4296556",
"signature_type": "Line"
},
{
"signature_version": "v1",
"target": {
"function": "ip6_tnl_parse_tlv_enc_lim",
"file": "net/ipv6/ip6_tunnel.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d375b98e0248980681e5e56b712026174d617198",
"digest": {
"length": 1036.0,
"function_hash": "114099873954175192158158945896272687193"
},
"deprecated": false,
"id": "CVE-2024-26633-d5e1abb7",
"signature_type": "Function"
},
{
"signature_version": "v1",
"target": {
"file": "net/ipv6/ip6_tunnel.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d375b98e0248980681e5e56b712026174d617198",
"digest": {
"line_hashes": [
"17479113808636102784349074221892354630",
"113437625532312164668741659541734285068",
"47255054419673340447793055250007521030",
"249018800678767323720856348334693661094",
"174609972792000762953062621162389996129",
"190924744299271616391109717675882025263",
"120657202304789483355444312475366146606",
"64224517788383539547642577775434167855",
"200058370505364799336824064716375596767",
"93199813760344348469713243141929365664",
"40765889810218258615805160826261016951",
"334477554518091820564278051640908248964",
"186551076358645054442492536812268931806",
"35146067235252272748621799531397869727",
"130921735170269262072929061887106639198",
"339120608265824829925538844609886717836",
"62282132103719406671804355976588795463",
"126299510622272756307812103230860157887",
"305732378124650168471089610861504635614",
"143324446433081478681700750634937207949",
"115470068533174480898602996655885408756",
"182999174266481141641243472205725391329",
"214149802737052845778757946292790135628",
"88372601779108907628077761709261209922",
"120784767890949267834425833489434574793"
],
"threshold": 0.9
},
"deprecated": false,
"id": "CVE-2024-26633-ee5ae90b",
"signature_type": "Line"
},
{
"signature_version": "v1",
"target": {
"file": "net/ipv6/ip6_tunnel.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@135414f300c5db995e2a2f3bf0f455de9d014aee",
"digest": {
"line_hashes": [
"17479113808636102784349074221892354630",
"113437625532312164668741659541734285068",
"47255054419673340447793055250007521030",
"249018800678767323720856348334693661094",
"174609972792000762953062621162389996129",
"190924744299271616391109717675882025263",
"120657202304789483355444312475366146606",
"64224517788383539547642577775434167855",
"200058370505364799336824064716375596767",
"294368787768452706930606758896110094328",
"330217434575502613408853096555148242771",
"167794296870397436869352092427487604107",
"12115370838067176998871598606719779516",
"35146067235252272748621799531397869727",
"130921735170269262072929061887106639198",
"339120608265824829925538844609886717836",
"62282132103719406671804355976588795463",
"126299510622272756307812103230860157887",
"305732378124650168471089610861504635614",
"143324446433081478681700750634937207949",
"115470068533174480898602996655885408756",
"182999174266481141641243472205725391329",
"214149802737052845778757946292790135628",
"88372601779108907628077761709261209922",
"120784767890949267834425833489434574793"
],
"threshold": 0.9
},
"deprecated": false,
"id": "CVE-2024-26633-fa4c0304",
"signature_type": "Line"
},
{
"signature_version": "v1",
"target": {
"file": "net/ipv6/ip6_tunnel.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@da23bd709b46168f7dfc36055801011222b076cd",
"digest": {
"line_hashes": [
"17479113808636102784349074221892354630",
"113437625532312164668741659541734285068",
"47255054419673340447793055250007521030",
"249018800678767323720856348334693661094",
"174609972792000762953062621162389996129",
"190924744299271616391109717675882025263",
"120657202304789483355444312475366146606",
"64224517788383539547642577775434167855",
"200058370505364799336824064716375596767",
"93199813760344348469713243141929365664",
"40765889810218258615805160826261016951",
"334477554518091820564278051640908248964",
"186551076358645054442492536812268931806",
"35146067235252272748621799531397869727",
"130921735170269262072929061887106639198",
"339120608265824829925538844609886717836",
"62282132103719406671804355976588795463",
"126299510622272756307812103230860157887",
"305732378124650168471089610861504635614",
"143324446433081478681700750634937207949",
"115470068533174480898602996655885408756",
"182999174266481141641243472205725391329",
"214149802737052845778757946292790135628",
"88372601779108907628077761709261209922",
"120784767890949267834425833489434574793"
],
"threshold": 0.9
},
"deprecated": false,
"id": "CVE-2024-26633-fadf5af7",
"signature_type": "Line"
}
]