In the Linux kernel, the following vulnerability has been resolved:
erspan: make sure erspanbasehdr is present in skb->head
syzbot reported a problem in ip6erspan_rcv() [1]
Issue is that ip6erspanrcv() (and erspanrcv()) no longer make sure erspanbasehdr is present in skb linear part (skb->head) before getting @ver field from it.
Add the missing pskbmaypull() calls.
v2: Reload iph pointer in erspanrcv() after pskbmay_pull() because skb->head might have changed.
[1]
BUG: KMSAN: uninit-value in pskbmaypullreason include/linux/skbuff.h:2742 [inline] BUG: KMSAN: uninit-value in pskbmaypull include/linux/skbuff.h:2756 [inline] BUG: KMSAN: uninit-value in ip6erspanrcv net/ipv6/ip6gre.c:541 [inline] BUG: KMSAN: uninit-value in grercv+0x11f8/0x1930 net/ipv6/ip6gre.c:610 pskbmaypullreason include/linux/skbuff.h:2742 [inline] pskbmaypull include/linux/skbuff.h:2756 [inline] ip6erspanrcv net/ipv6/ip6gre.c:541 [inline] grercv+0x11f8/0x1930 net/ipv6/ip6gre.c:610 ip6protocoldeliverrcu+0x1d4c/0x2ca0 net/ipv6/ip6input.c:438 ip6inputfinish net/ipv6/ip6input.c:483 [inline] NFHOOK include/linux/netfilter.h:314 [inline] ip6input+0x15d/0x430 net/ipv6/ip6input.c:492 ip6mcinput+0xa7e/0xc80 net/ipv6/ip6input.c:586 dstinput include/net/dst.h:460 [inline] ip6rcvfinish+0x955/0x970 net/ipv6/ip6input.c:79 NFHOOK include/linux/netfilter.h:314 [inline] ipv6rcv+0xde/0x390 net/ipv6/ip6input.c:310 _netifreceiveskbonecore net/core/dev.c:5538 [inline] _netifreceiveskb+0x1da/0xa00 net/core/dev.c:5652 netifreceiveskbinternal net/core/dev.c:5738 [inline] netifreceiveskb+0x58/0x660 net/core/dev.c:5798 tunrxbatched+0x3ee/0x980 drivers/net/tun.c:1549 tungetuser+0x5566/0x69e0 drivers/net/tun.c:2002 tunchrwriteiter+0x3af/0x5d0 drivers/net/tun.c:2048 callwriteiter include/linux/fs.h:2108 [inline] newsyncwrite fs/readwrite.c:497 [inline] vfswrite+0xb63/0x1520 fs/readwrite.c:590 ksyswrite+0x20f/0x4c0 fs/readwrite.c:643 _dosyswrite fs/readwrite.c:655 [inline] _sesyswrite fs/readwrite.c:652 [inline] _x64syswrite+0x93/0xe0 fs/readwrite.c:652 dosyscall64+0xd5/0x1f0 entrySYSCALL64after_hwframe+0x6d/0x75
Uninit was created at: slabpostallochook mm/slub.c:3804 [inline] slaballocnode mm/slub.c:3845 [inline] kmemcacheallocnode+0x613/0xc50 mm/slub.c:3888 kmallocreserve+0x13d/0x4a0 net/core/skbuff.c:577 _allocskb+0x35b/0x7a0 net/core/skbuff.c:668 allocskb include/linux/skbuff.h:1318 [inline] allocskbwithfrags+0xc8/0xbf0 net/core/skbuff.c:6504 sockallocsendpskb+0xa81/0xbf0 net/core/sock.c:2795 tunallocskb drivers/net/tun.c:1525 [inline] tungetuser+0x209a/0x69e0 drivers/net/tun.c:1846 tunchrwriteiter+0x3af/0x5d0 drivers/net/tun.c:2048 callwriteiter include/linux/fs.h:2108 [inline] newsyncwrite fs/readwrite.c:497 [inline] vfswrite+0xb63/0x1520 fs/readwrite.c:590 ksyswrite+0x20f/0x4c0 fs/readwrite.c:643 _dosyswrite fs/readwrite.c:655 [inline] _sesyswrite fs/readwrite.c:652 [inline] _x64syswrite+0x93/0xe0 fs/readwrite.c:652 dosyscall64+0xd5/0x1f0 entrySYSCALL64afterhwframe+0x6d/0x75
CPU: 1 PID: 5045 Comm: syz-executor114 Not tainted 6.9.0-rc1-syzkaller-00021-g962490525cff #0
{ "vanir_signatures": [ { "signature_version": "v1", "target": { "file": "net/ipv6/ip6_gre.c" }, "signature_type": "Line", "id": "CVE-2024-35888-004663db", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@17af420545a750f763025149fa7b833a4fc8b8f0", "digest": { "threshold": 0.9, "line_hashes": [ "148239489913151560069216698913958808503", "258507672907708051054701873539020104624", "179787855350526494892069401462868287454" ] }, "deprecated": false }, { "signature_version": "v1", "target": { "file": "net/ipv4/ip_gre.c", "function": "erspan_rcv" }, "signature_type": "Function", "id": "CVE-2024-35888-02f37502", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0ac328a5a4138a6c03dfc3f46017bd5c19167446", "digest": { "length": 1755.0, "function_hash": "216265699356150356619476432110737780225" }, "deprecated": false }, { "signature_version": "v1", "target": { "file": "net/ipv4/ip_gre.c" }, "signature_type": "Line", "id": "CVE-2024-35888-0b9bd277", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e54a0c79cdc2548729dd7e2e468b08c5af4d0df5", "digest": { "threshold": 0.9, "line_hashes": [ "198415810018883988696837597328544473287", "17471749091142565581703768093435945092", "233841111014747296010277523763309552236", "290511904754091662373967214814893734750", "154059883007639380925101925565007900833", "280496382523879791351998133792024705791" ] }, "deprecated": false }, { "signature_version": "v1", "target": { "file": "net/ipv6/ip6_gre.c", "function": "ip6erspan_rcv" }, "signature_type": "Function", "id": "CVE-2024-35888-11e8eb52", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ee0088101beee10fa809716d6245d915b09c37c7", "digest": { "length": 1389.0, "function_hash": "58198672400172611334867092816460077280" }, "deprecated": false }, { "signature_version": "v1", "target": { "file": "net/ipv6/ip6_gre.c" }, "signature_type": "Line", "id": "CVE-2024-35888-3296a04c", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4e3fdeecec5707678b0d1f18c259dadb97262e9d", "digest": { "threshold": 0.9, "line_hashes": [ "148239489913151560069216698913958808503", "258507672907708051054701873539020104624", "179787855350526494892069401462868287454" ] }, "deprecated": false }, { "signature_version": "v1", "target": { "file": "net/ipv4/ip_gre.c", "function": "erspan_rcv" }, "signature_type": "Function", "id": "CVE-2024-35888-367b5cb7", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@17af420545a750f763025149fa7b833a4fc8b8f0", "digest": { "length": 1755.0, "function_hash": "216265699356150356619476432110737780225" }, "deprecated": false }, { "signature_version": "v1", "target": { "file": "net/ipv4/ip_gre.c" }, "signature_type": "Line", "id": "CVE-2024-35888-424b364e", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4e3fdeecec5707678b0d1f18c259dadb97262e9d", "digest": { "threshold": 0.9, "line_hashes": [ "198415810018883988696837597328544473287", "17471749091142565581703768093435945092", "233841111014747296010277523763309552236", "290511904754091662373967214814893734750", "154059883007639380925101925565007900833", "280496382523879791351998133792024705791" ] }, "deprecated": false }, { "signature_version": "v1", "target": { "file": "net/ipv6/ip6_gre.c", "function": "ip6erspan_rcv" }, "signature_type": "Function", "id": "CVE-2024-35888-4a02a4a2", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@17af420545a750f763025149fa7b833a4fc8b8f0", "digest": { "length": 1389.0, "function_hash": "58198672400172611334867092816460077280" }, "deprecated": false }, { "signature_version": "v1", "target": { "file": "net/ipv6/ip6_gre.c", "function": "ip6erspan_rcv" }, "signature_type": "Function", "id": "CVE-2024-35888-4d191fca", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0ac328a5a4138a6c03dfc3f46017bd5c19167446", "digest": { "length": 1389.0, "function_hash": "58198672400172611334867092816460077280" }, "deprecated": false }, { "signature_version": "v1", "target": { "file": "net/ipv4/ip_gre.c", "function": "erspan_rcv" }, "signature_type": "Function", "id": "CVE-2024-35888-5b499656", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1db7fcb2b290c47c202b79528824f119fa28937d", "digest": { "length": 1755.0, "function_hash": "216265699356150356619476432110737780225" }, "deprecated": false }, { "signature_version": "v1", "target": { "file": "net/ipv4/ip_gre.c" }, "signature_type": "Line", "id": "CVE-2024-35888-652fbb2c", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@17af420545a750f763025149fa7b833a4fc8b8f0", "digest": { "threshold": 0.9, "line_hashes": [ "198415810018883988696837597328544473287", "17471749091142565581703768093435945092", "233841111014747296010277523763309552236", "290511904754091662373967214814893734750", "154059883007639380925101925565007900833", "280496382523879791351998133792024705791" ] }, "deprecated": false }, { "signature_version": "v1", "target": { "file": "net/ipv6/ip6_gre.c" }, "signature_type": "Line", "id": "CVE-2024-35888-69a4d92a", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@06a939f72a24a7d8251f84cf4c042df86c6666ac", "digest": { "threshold": 0.9, "line_hashes": [ "148239489913151560069216698913958808503", "258507672907708051054701873539020104624", "179787855350526494892069401462868287454" ] }, "deprecated": false }, { "signature_version": "v1", "target": { "file": "net/ipv6/ip6_gre.c", "function": "ip6erspan_rcv" }, "signature_type": "Function", "id": "CVE-2024-35888-6e1b3142", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e54a0c79cdc2548729dd7e2e468b08c5af4d0df5", "digest": { "length": 1389.0, "function_hash": "58198672400172611334867092816460077280" }, "deprecated": false }, { "signature_version": "v1", "target": { "file": "net/ipv4/ip_gre.c", "function": "erspan_rcv" }, "signature_type": "Function", "id": "CVE-2024-35888-6f07eba8", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ee0088101beee10fa809716d6245d915b09c37c7", "digest": { "length": 1755.0, "function_hash": "216265699356150356619476432110737780225" }, "deprecated": false }, { "signature_version": "v1", "target": { "file": "net/ipv6/ip6_gre.c" }, "signature_type": "Line", "id": "CVE-2024-35888-70158e3e", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0ac328a5a4138a6c03dfc3f46017bd5c19167446", "digest": { "threshold": 0.9, "line_hashes": [ "148239489913151560069216698913958808503", "258507672907708051054701873539020104624", "179787855350526494892069401462868287454" ] }, "deprecated": false }, { "signature_version": "v1", "target": { "file": "net/ipv6/ip6_gre.c" }, "signature_type": "Line", "id": "CVE-2024-35888-719c7647", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b14b9f9503ec823ca75be766dcaeff4f0bfeca85", "digest": { "threshold": 0.9, "line_hashes": [ "148239489913151560069216698913958808503", "258507672907708051054701873539020104624", "179787855350526494892069401462868287454" ] }, "deprecated": false }, { "signature_version": "v1", "target": { "file": "net/ipv4/ip_gre.c", "function": "erspan_rcv" }, "signature_type": "Function", "id": "CVE-2024-35888-7a8ff18f", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e54a0c79cdc2548729dd7e2e468b08c5af4d0df5", "digest": { "length": 1755.0, "function_hash": "216265699356150356619476432110737780225" }, "deprecated": false }, { "signature_version": "v1", "target": { "file": "net/ipv6/ip6_gre.c", "function": "ip6erspan_rcv" }, "signature_type": "Function", "id": "CVE-2024-35888-8f8bdb07", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b14b9f9503ec823ca75be766dcaeff4f0bfeca85", "digest": { "length": 1389.0, "function_hash": "58198672400172611334867092816460077280" }, "deprecated": false }, { "signature_version": "v1", "target": { "file": "net/ipv6/ip6_gre.c", "function": "ip6erspan_rcv" }, "signature_type": "Function", "id": "CVE-2024-35888-977c6097", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4e3fdeecec5707678b0d1f18c259dadb97262e9d", "digest": { "length": 1389.0, "function_hash": "58198672400172611334867092816460077280" }, "deprecated": false }, { "signature_version": "v1", "target": { "file": "net/ipv4/ip_gre.c", "function": "erspan_rcv" }, "signature_type": "Function", "id": "CVE-2024-35888-9800edbe", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@06a939f72a24a7d8251f84cf4c042df86c6666ac", "digest": { "length": 1755.0, "function_hash": "216265699356150356619476432110737780225" }, "deprecated": false }, { "signature_version": "v1", "target": { "file": "net/ipv4/ip_gre.c", "function": "erspan_rcv" }, "signature_type": "Function", "id": "CVE-2024-35888-a2a9ca53", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4e3fdeecec5707678b0d1f18c259dadb97262e9d", "digest": { "length": 1755.0, "function_hash": "216265699356150356619476432110737780225" }, "deprecated": false }, { "signature_version": "v1", "target": { "file": "net/ipv6/ip6_gre.c" }, "signature_type": "Line", "id": "CVE-2024-35888-a5cfd677", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1db7fcb2b290c47c202b79528824f119fa28937d", "digest": { "threshold": 0.9, "line_hashes": [ "148239489913151560069216698913958808503", "258507672907708051054701873539020104624", "179787855350526494892069401462868287454" ] }, "deprecated": false }, { "signature_version": "v1", "target": { "file": "net/ipv6/ip6_gre.c" }, "signature_type": "Line", "id": "CVE-2024-35888-ad5b5001", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ee0088101beee10fa809716d6245d915b09c37c7", "digest": { "threshold": 0.9, "line_hashes": [ "148239489913151560069216698913958808503", "258507672907708051054701873539020104624", "179787855350526494892069401462868287454" ] }, "deprecated": false }, { "signature_version": "v1", "target": { "file": "net/ipv6/ip6_gre.c" }, "signature_type": "Line", "id": "CVE-2024-35888-ad7d5532", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e54a0c79cdc2548729dd7e2e468b08c5af4d0df5", "digest": { "threshold": 0.9, "line_hashes": [ "148239489913151560069216698913958808503", "258507672907708051054701873539020104624", "179787855350526494892069401462868287454" ] }, "deprecated": false }, { "signature_version": "v1", "target": { "file": "net/ipv4/ip_gre.c" }, "signature_type": "Line", "id": "CVE-2024-35888-bdfbf3cf", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1db7fcb2b290c47c202b79528824f119fa28937d", "digest": { "threshold": 0.9, "line_hashes": [ "198415810018883988696837597328544473287", "17471749091142565581703768093435945092", "233841111014747296010277523763309552236", "290511904754091662373967214814893734750", "154059883007639380925101925565007900833", "280496382523879791351998133792024705791" ] }, "deprecated": false }, { "signature_version": "v1", "target": { "file": "net/ipv4/ip_gre.c", "function": "erspan_rcv" }, "signature_type": "Function", "id": "CVE-2024-35888-be4f29c2", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b14b9f9503ec823ca75be766dcaeff4f0bfeca85", "digest": { "length": 1755.0, "function_hash": "216265699356150356619476432110737780225" }, "deprecated": false }, { "signature_version": "v1", "target": { "file": "net/ipv4/ip_gre.c" }, "signature_type": "Line", "id": "CVE-2024-35888-ce12758c", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@06a939f72a24a7d8251f84cf4c042df86c6666ac", "digest": { "threshold": 0.9, "line_hashes": [ "198415810018883988696837597328544473287", "17471749091142565581703768093435945092", "233841111014747296010277523763309552236", "290511904754091662373967214814893734750", "154059883007639380925101925565007900833", "280496382523879791351998133792024705791" ] }, "deprecated": false }, { "signature_version": "v1", "target": { "file": "net/ipv4/ip_gre.c" }, "signature_type": "Line", "id": "CVE-2024-35888-d8988a90", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b14b9f9503ec823ca75be766dcaeff4f0bfeca85", "digest": { "threshold": 0.9, "line_hashes": [ "198415810018883988696837597328544473287", "17471749091142565581703768093435945092", "233841111014747296010277523763309552236", "290511904754091662373967214814893734750", "154059883007639380925101925565007900833", "280496382523879791351998133792024705791" ] }, "deprecated": false }, { "signature_version": "v1", "target": { "file": "net/ipv4/ip_gre.c" }, "signature_type": "Line", "id": "CVE-2024-35888-da807630", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ee0088101beee10fa809716d6245d915b09c37c7", "digest": { "threshold": 0.9, "line_hashes": [ "198415810018883988696837597328544473287", "17471749091142565581703768093435945092", "233841111014747296010277523763309552236", "290511904754091662373967214814893734750", "154059883007639380925101925565007900833", "280496382523879791351998133792024705791" ] }, "deprecated": false }, { "signature_version": "v1", "target": { "file": "net/ipv6/ip6_gre.c", "function": "ip6erspan_rcv" }, "signature_type": "Function", "id": "CVE-2024-35888-e084febf", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@06a939f72a24a7d8251f84cf4c042df86c6666ac", "digest": { "length": 1389.0, "function_hash": "58198672400172611334867092816460077280" }, "deprecated": false }, { "signature_version": "v1", "target": { "file": "net/ipv4/ip_gre.c" }, "signature_type": "Line", "id": "CVE-2024-35888-f60e4bc1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0ac328a5a4138a6c03dfc3f46017bd5c19167446", "digest": { "threshold": 0.9, "line_hashes": [ "198415810018883988696837597328544473287", "17471749091142565581703768093435945092", "233841111014747296010277523763309552236", "290511904754091662373967214814893734750", "154059883007639380925101925565007900833", "280496382523879791351998133792024705791" ] }, "deprecated": false }, { "signature_version": "v1", "target": { "file": "net/ipv6/ip6_gre.c", "function": "ip6erspan_rcv" }, "signature_type": "Function", "id": "CVE-2024-35888-f81a6cca", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1db7fcb2b290c47c202b79528824f119fa28937d", "digest": { "length": 1389.0, "function_hash": "58198672400172611334867092816460077280" }, "deprecated": false } ] }