In the Linux kernel, the following vulnerability has been resolved:
net: fix out-of-bounds access in ops_init
netallocgeneric is called by netalloc, which is called without any locking. It reads maxgenptrs, which is changed under pernetops_rwsem. It is read twice, first to allocate an array, then to set s.len, which is later used to limit the bounds of the array access.
It is possible that the array is allocated and another thread is registering a new pernet ops, increments maxgenptrs, which is then used to set s.len with a larger than allocated length for the variable array.
Fix it by reading maxgenptrs only once in netallocgeneric. If maxgenptrs is later incremented, it will be caught in netassigngeneric.
[
{
"id": "CVE-2024-36883-0107ed97",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a26ff37e624d12e28077e5b24d2b264f62764ad6",
"signature_version": "v1",
"target": {
"file": "net/core/net_namespace.c",
"function": "register_pernet_operations"
},
"deprecated": false,
"signature_type": "Function",
"digest": {
"length": 425.0,
"function_hash": "64995110795360570476278481176832743308"
}
},
{
"id": "CVE-2024-36883-02894694",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a26ff37e624d12e28077e5b24d2b264f62764ad6",
"signature_version": "v1",
"target": {
"file": "net/core/net_namespace.c"
},
"deprecated": false,
"signature_type": "Line",
"digest": {
"line_hashes": [
"174392573017779481850238954128402494473",
"14567079540547008434300804427995981241",
"56330620173937386079368373799186620680",
"142383329674135563333072009232826715586",
"192425837606895019227443195637721141129",
"630721498399284247564870449159768881",
"285972574878180180749829071648300859262",
"312962580233956506248724664683049394119",
"172024880134450583990380214299569257644",
"150486252625465815906580968060944686599",
"155929125420898559479231917311796636061",
"201778512092033679919572509032055096893",
"101894710425586983272772431972076441891"
],
"threshold": 0.9
}
},
{
"id": "CVE-2024-36883-0d306c6e",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3cdc34d76c4f777579e28ad373979d36c030cfd3",
"signature_version": "v1",
"target": {
"file": "net/core/net_namespace.c",
"function": "register_pernet_operations"
},
"deprecated": false,
"signature_type": "Function",
"digest": {
"length": 425.0,
"function_hash": "64995110795360570476278481176832743308"
}
},
{
"id": "CVE-2024-36883-16786fd3",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b6dbfd5bcc267a95a0bf1bf96af46243f96ec6cd",
"signature_version": "v1",
"target": {
"file": "net/core/net_namespace.c",
"function": "register_pernet_operations"
},
"deprecated": false,
"signature_type": "Function",
"digest": {
"length": 425.0,
"function_hash": "64995110795360570476278481176832743308"
}
},
{
"id": "CVE-2024-36883-3a0b6035",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a26ff37e624d12e28077e5b24d2b264f62764ad6",
"signature_version": "v1",
"target": {
"file": "net/core/net_namespace.c",
"function": "net_alloc_generic"
},
"deprecated": false,
"signature_type": "Function",
"digest": {
"length": 226.0,
"function_hash": "134854999922692342229890182228359389750"
}
},
{
"id": "CVE-2024-36883-4935fb30",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9518b79bfd2fbf99fa9b7e8e36bcb1825e7ba030",
"signature_version": "v1",
"target": {
"file": "net/core/net_namespace.c"
},
"deprecated": false,
"signature_type": "Line",
"digest": {
"line_hashes": [
"174392573017779481850238954128402494473",
"14567079540547008434300804427995981241",
"56330620173937386079368373799186620680",
"142383329674135563333072009232826715586",
"192425837606895019227443195637721141129",
"630721498399284247564870449159768881",
"285972574878180180749829071648300859262",
"312962580233956506248724664683049394119",
"172024880134450583990380214299569257644",
"150486252625465815906580968060944686599",
"155929125420898559479231917311796636061",
"201778512092033679919572509032055096893",
"101894710425586983272772431972076441891"
],
"threshold": 0.9
}
},
{
"id": "CVE-2024-36883-50205797",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3cdc34d76c4f777579e28ad373979d36c030cfd3",
"signature_version": "v1",
"target": {
"file": "net/core/net_namespace.c",
"function": "net_alloc_generic"
},
"deprecated": false,
"signature_type": "Function",
"digest": {
"length": 226.0,
"function_hash": "134854999922692342229890182228359389750"
}
},
{
"id": "CVE-2024-36883-6183088c",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9518b79bfd2fbf99fa9b7e8e36bcb1825e7ba030",
"signature_version": "v1",
"target": {
"file": "net/core/net_namespace.c",
"function": "register_pernet_operations"
},
"deprecated": false,
"signature_type": "Function",
"digest": {
"length": 425.0,
"function_hash": "64995110795360570476278481176832743308"
}
},
{
"id": "CVE-2024-36883-81598602",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b6dbfd5bcc267a95a0bf1bf96af46243f96ec6cd",
"signature_version": "v1",
"target": {
"file": "net/core/net_namespace.c"
},
"deprecated": false,
"signature_type": "Line",
"digest": {
"line_hashes": [
"174392573017779481850238954128402494473",
"14567079540547008434300804427995981241",
"56330620173937386079368373799186620680",
"142383329674135563333072009232826715586",
"192425837606895019227443195637721141129",
"630721498399284247564870449159768881",
"285972574878180180749829071648300859262",
"312962580233956506248724664683049394119",
"172024880134450583990380214299569257644",
"150486252625465815906580968060944686599",
"155929125420898559479231917311796636061",
"201778512092033679919572509032055096893",
"101894710425586983272772431972076441891"
],
"threshold": 0.9
}
},
{
"id": "CVE-2024-36883-8aca8d57",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f4f94587e1bf87cb40ec33955a9d90148dd026ab",
"signature_version": "v1",
"target": {
"file": "net/core/net_namespace.c",
"function": "register_pernet_operations"
},
"deprecated": false,
"signature_type": "Function",
"digest": {
"length": 425.0,
"function_hash": "64995110795360570476278481176832743308"
}
},
{
"id": "CVE-2024-36883-931fd9eb",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7b0e64583eab8c1d896b47e5dd0bf2e7d86ec41f",
"signature_version": "v1",
"target": {
"file": "net/core/net_namespace.c",
"function": "net_alloc_generic"
},
"deprecated": false,
"signature_type": "Function",
"digest": {
"length": 226.0,
"function_hash": "134854999922692342229890182228359389750"
}
},
{
"id": "CVE-2024-36883-938c7cc3",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9518b79bfd2fbf99fa9b7e8e36bcb1825e7ba030",
"signature_version": "v1",
"target": {
"file": "net/core/net_namespace.c",
"function": "net_alloc_generic"
},
"deprecated": false,
"signature_type": "Function",
"digest": {
"length": 226.0,
"function_hash": "134854999922692342229890182228359389750"
}
},
{
"id": "CVE-2024-36883-96cddeb8",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3cdc34d76c4f777579e28ad373979d36c030cfd3",
"signature_version": "v1",
"target": {
"file": "net/core/net_namespace.c"
},
"deprecated": false,
"signature_type": "Line",
"digest": {
"line_hashes": [
"237058444344628725523230841018637288663",
"57510009661469274878293629477378871836",
"56330620173937386079368373799186620680",
"142383329674135563333072009232826715586",
"192425837606895019227443195637721141129",
"630721498399284247564870449159768881",
"285972574878180180749829071648300859262",
"312962580233956506248724664683049394119",
"172024880134450583990380214299569257644",
"150486252625465815906580968060944686599",
"155929125420898559479231917311796636061",
"201778512092033679919572509032055096893",
"101894710425586983272772431972076441891"
],
"threshold": 0.9
}
},
{
"id": "CVE-2024-36883-972eb26a",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7b0e64583eab8c1d896b47e5dd0bf2e7d86ec41f",
"signature_version": "v1",
"target": {
"file": "net/core/net_namespace.c",
"function": "register_pernet_operations"
},
"deprecated": false,
"signature_type": "Function",
"digest": {
"length": 425.0,
"function_hash": "64995110795360570476278481176832743308"
}
},
{
"id": "CVE-2024-36883-99f8be73",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0c3248bc708a7797be573214065cf908ff1f54c7",
"signature_version": "v1",
"target": {
"file": "net/core/net_namespace.c",
"function": "register_pernet_operations"
},
"deprecated": false,
"signature_type": "Function",
"digest": {
"length": 425.0,
"function_hash": "64995110795360570476278481176832743308"
}
},
{
"id": "CVE-2024-36883-b4c701c4",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b6dbfd5bcc267a95a0bf1bf96af46243f96ec6cd",
"signature_version": "v1",
"target": {
"file": "net/core/net_namespace.c",
"function": "net_alloc_generic"
},
"deprecated": false,
"signature_type": "Function",
"digest": {
"length": 226.0,
"function_hash": "134854999922692342229890182228359389750"
}
},
{
"id": "CVE-2024-36883-b9228161",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f4f94587e1bf87cb40ec33955a9d90148dd026ab",
"signature_version": "v1",
"target": {
"file": "net/core/net_namespace.c"
},
"deprecated": false,
"signature_type": "Line",
"digest": {
"line_hashes": [
"174392573017779481850238954128402494473",
"14567079540547008434300804427995981241",
"56330620173937386079368373799186620680",
"142383329674135563333072009232826715586",
"192425837606895019227443195637721141129",
"630721498399284247564870449159768881",
"285972574878180180749829071648300859262",
"312962580233956506248724664683049394119",
"172024880134450583990380214299569257644",
"150486252625465815906580968060944686599",
"155929125420898559479231917311796636061",
"201778512092033679919572509032055096893",
"101894710425586983272772431972076441891"
],
"threshold": 0.9
}
},
{
"id": "CVE-2024-36883-ea44ea28",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f4f94587e1bf87cb40ec33955a9d90148dd026ab",
"signature_version": "v1",
"target": {
"file": "net/core/net_namespace.c",
"function": "net_alloc_generic"
},
"deprecated": false,
"signature_type": "Function",
"digest": {
"length": 226.0,
"function_hash": "134854999922692342229890182228359389750"
}
},
{
"id": "CVE-2024-36883-ee329643",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0c3248bc708a7797be573214065cf908ff1f54c7",
"signature_version": "v1",
"target": {
"file": "net/core/net_namespace.c"
},
"deprecated": false,
"signature_type": "Line",
"digest": {
"line_hashes": [
"36413444822412594106425231005742103495",
"17453097204079584363369794650562491133",
"56330620173937386079368373799186620680",
"142383329674135563333072009232826715586",
"192425837606895019227443195637721141129",
"630721498399284247564870449159768881",
"285972574878180180749829071648300859262",
"312962580233956506248724664683049394119",
"172024880134450583990380214299569257644",
"150486252625465815906580968060944686599",
"155929125420898559479231917311796636061",
"201778512092033679919572509032055096893",
"101894710425586983272772431972076441891"
],
"threshold": 0.9
}
},
{
"id": "CVE-2024-36883-ef58dd37",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7b0e64583eab8c1d896b47e5dd0bf2e7d86ec41f",
"signature_version": "v1",
"target": {
"file": "net/core/net_namespace.c"
},
"deprecated": false,
"signature_type": "Line",
"digest": {
"line_hashes": [
"237058444344628725523230841018637288663",
"57510009661469274878293629477378871836",
"56330620173937386079368373799186620680",
"142383329674135563333072009232826715586",
"192425837606895019227443195637721141129",
"630721498399284247564870449159768881",
"285972574878180180749829071648300859262",
"312962580233956506248724664683049394119",
"172024880134450583990380214299569257644",
"150486252625465815906580968060944686599",
"155929125420898559479231917311796636061",
"201778512092033679919572509032055096893",
"101894710425586983272772431972076441891"
],
"threshold": 0.9
}
},
{
"id": "CVE-2024-36883-ff9abb14",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0c3248bc708a7797be573214065cf908ff1f54c7",
"signature_version": "v1",
"target": {
"file": "net/core/net_namespace.c",
"function": "net_alloc_generic"
},
"deprecated": false,
"signature_type": "Function",
"digest": {
"length": 226.0,
"function_hash": "134854999922692342229890182228359389750"
}
}
]