In the Linux kernel, the following vulnerability has been resolved:
ipv4: Fix uninit-value access in _ipmake_skb()
KMSAN reported uninit-value access in _ipmakeskb() [1]. _ipmakeskb() tests HDRINCL to know if the skb has icmphdr. However, HDRINCL can cause a race condition. If calling setsockopt(2) with IPHDRINCL changes HDRINCL while _ipmakeskb() is running, the function will access icmphdr in the skb even if it is not included. This causes the issue reported by KMSAN.
Check FLOWIFLAGKNOWNNH on fl4->flowi4flags instead of testing HDRINCL on the socket.
Also, fl4->fl4icmptype and fl4->fl4icmpcode are not initialized. These are union in struct flowi4 and are implicitly initialized by flowi4initoutput(), but we should not rely on specific union layout.
Initialize these explicitly in raw_sendmsg().
[1] BUG: KMSAN: uninit-value in _ipmakeskb+0x2b74/0x2d20 net/ipv4/ipoutput.c:1481 _ipmakeskb+0x2b74/0x2d20 net/ipv4/ipoutput.c:1481 ipfinishskb include/net/ip.h:243 [inline] ippushpendingframes+0x4c/0x5c0 net/ipv4/ipoutput.c:1508 rawsendmsg+0x2381/0x2690 net/ipv4/raw.c:654 inetsendmsg+0x27b/0x2a0 net/ipv4/afinet.c:851 socksendmsgnosec net/socket.c:730 [inline] _socksendmsg+0x274/0x3c0 net/socket.c:745 _syssendto+0x62c/0x7b0 net/socket.c:2191 _dosyssendto net/socket.c:2203 [inline] _sesyssendto net/socket.c:2199 [inline] _x64syssendto+0x130/0x200 net/socket.c:2199 dosyscall64+0xd8/0x1f0 arch/x86/entry/common.c:83 entrySYSCALL64afterhwframe+0x6d/0x75
Uninit was created at: slabpostallochook mm/slub.c:3804 [inline] slaballocnode mm/slub.c:3845 [inline] kmemcacheallocnode+0x5f6/0xc50 mm/slub.c:3888 kmallocreserve+0x13c/0x4a0 net/core/skbuff.c:577 _allocskb+0x35a/0x7c0 net/core/skbuff.c:668 allocskb include/linux/skbuff.h:1318 [inline] _ipappenddata+0x49ab/0x68c0 net/ipv4/ipoutput.c:1128 ipappenddata+0x1e7/0x260 net/ipv4/ipoutput.c:1365 rawsendmsg+0x22b1/0x2690 net/ipv4/raw.c:648 inetsendmsg+0x27b/0x2a0 net/ipv4/afinet.c:851 socksendmsgnosec net/socket.c:730 [inline] _socksendmsg+0x274/0x3c0 net/socket.c:745 _syssendto+0x62c/0x7b0 net/socket.c:2191 _dosyssendto net/socket.c:2203 [inline] _sesyssendto net/socket.c:2199 [inline] _x64syssendto+0x130/0x200 net/socket.c:2199 dosyscall64+0xd8/0x1f0 arch/x86/entry/common.c:83 entrySYSCALL64after_hwframe+0x6d/0x75
CPU: 1 PID: 15709 Comm: syz-executor.7 Not tainted 6.8.0-11567-gb3603fcb79b1 #25 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-1.fc39 04/01/2014
[ { "signature_type": "Function", "target": { "function": "raw_sendmsg", "file": "net/ipv4/raw.c" }, "deprecated": false, "digest": { "function_hash": "226187810187555619076594265319293367294", "length": 3563.0 }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f5c603ad4e6fcf42f84053e882ebe20184bb309e", "signature_version": "v1", "id": "CVE-2024-36927-065880c7" }, { "signature_type": "Line", "target": { "file": "net/ipv4/raw.c" }, "deprecated": false, "digest": { "threshold": 0.9, "line_hashes": [ "6658039989093133642735281801954658783", "109562569123395258655185059620553581903", "51570235588286758110518763294963347814" ] }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fc1092f51567277509563800a3c56732070b6aa4", "signature_version": "v1", "id": "CVE-2024-36927-5691da30" }, { "signature_type": "Function", "target": { "function": "__ip_make_skb", "file": "net/ipv4/ip_output.c" }, "deprecated": false, "digest": { "function_hash": "112543942948445924814065609334632783618", "length": 2085.0 }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fc1092f51567277509563800a3c56732070b6aa4", "signature_version": "v1", "id": "CVE-2024-36927-5bf7254d" }, { "signature_type": "Line", "target": { "file": "net/ipv4/raw.c" }, "deprecated": false, "digest": { "threshold": 0.9, "line_hashes": [ "6658039989093133642735281801954658783", "109562569123395258655185059620553581903", "51570235588286758110518763294963347814" ] }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@55bf541e018b76b3750cb6c6ea18c46e1ac5562e", "signature_version": "v1", "id": "CVE-2024-36927-66d1aa2d" }, { "signature_type": "Line", "target": { "file": "net/ipv4/ip_output.c" }, "deprecated": false, "digest": { "threshold": 0.9, "line_hashes": [ "233336530581354488941870541815484058737", "316593820192121210814012391811239413322", "80714620046202712860729233927922315978", "307942847375844982354106904802523953188" ] }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@55bf541e018b76b3750cb6c6ea18c46e1ac5562e", "signature_version": "v1", "id": "CVE-2024-36927-6ab9ef47" }, { "signature_type": "Function", "target": { "function": "__ip_make_skb", "file": "net/ipv4/ip_output.c" }, "deprecated": false, "digest": { "function_hash": "57517569886575670458540431469063867214", "length": 2032.0 }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5db08343ddb1b239320612036c398e4e1bb52818", "signature_version": "v1", "id": "CVE-2024-36927-6d15894f" }, { "signature_type": "Function", "target": { "function": "__ip_make_skb", "file": "net/ipv4/ip_output.c" }, "deprecated": false, "digest": { "function_hash": "112543942948445924814065609334632783618", "length": 2085.0 }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f5c603ad4e6fcf42f84053e882ebe20184bb309e", "signature_version": "v1", "id": "CVE-2024-36927-71b75e23" }, { "signature_type": "Function", "target": { "function": "raw_sendmsg", "file": "net/ipv4/raw.c" }, "deprecated": false, "digest": { "function_hash": "231935245959335213333996604025186663849", "length": 3559.0 }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5db08343ddb1b239320612036c398e4e1bb52818", "signature_version": "v1", "id": "CVE-2024-36927-86efe32c" }, { "signature_type": "Line", "target": { "file": "net/ipv4/raw.c" }, "deprecated": false, "digest": { "threshold": 0.9, "line_hashes": [ "6658039989093133642735281801954658783", "109562569123395258655185059620553581903", "51570235588286758110518763294963347814" ] }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5db08343ddb1b239320612036c398e4e1bb52818", "signature_version": "v1", "id": "CVE-2024-36927-9641cb87" }, { "signature_type": "Line", "target": { "file": "net/ipv4/ip_output.c" }, "deprecated": false, "digest": { "threshold": 0.9, "line_hashes": [ "264354688422925282936348223816689367212", "182024777034758841580598044903692369911", "50518087854486062921206584413621337749", "16486471258349439955716333056074272817" ] }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f5c603ad4e6fcf42f84053e882ebe20184bb309e", "signature_version": "v1", "id": "CVE-2024-36927-9e3cc2a1" }, { "signature_type": "Line", "target": { "file": "net/ipv4/raw.c" }, "deprecated": false, "digest": { "threshold": 0.9, "line_hashes": [ "6658039989093133642735281801954658783", "109562569123395258655185059620553581903", "51570235588286758110518763294963347814" ] }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f5c603ad4e6fcf42f84053e882ebe20184bb309e", "signature_version": "v1", "id": "CVE-2024-36927-c4152dfe" }, { "signature_type": "Line", "target": { "file": "net/ipv4/ip_output.c" }, "deprecated": false, "digest": { "threshold": 0.9, "line_hashes": [ "264354688422925282936348223816689367212", "182024777034758841580598044903692369911", "50518087854486062921206584413621337749", "16486471258349439955716333056074272817" ] }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5db08343ddb1b239320612036c398e4e1bb52818", "signature_version": "v1", "id": "CVE-2024-36927-c6b43aac" }, { "signature_type": "Function", "target": { "function": "__ip_make_skb", "file": "net/ipv4/ip_output.c" }, "deprecated": false, "digest": { "function_hash": "92132193634442211316917977559451967355", "length": 2033.0 }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@55bf541e018b76b3750cb6c6ea18c46e1ac5562e", "signature_version": "v1", "id": "CVE-2024-36927-d2a02b64" }, { "signature_type": "Line", "target": { "file": "net/ipv4/ip_output.c" }, "deprecated": false, "digest": { "threshold": 0.9, "line_hashes": [ "264354688422925282936348223816689367212", "182024777034758841580598044903692369911", "50518087854486062921206584413621337749", "16486471258349439955716333056074272817" ] }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fc1092f51567277509563800a3c56732070b6aa4", "signature_version": "v1", "id": "CVE-2024-36927-d544cedf" }, { "signature_type": "Function", "target": { "function": "raw_sendmsg", "file": "net/ipv4/raw.c" }, "deprecated": false, "digest": { "function_hash": "181544335047720538450106296409141983604", "length": 3583.0 }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@55bf541e018b76b3750cb6c6ea18c46e1ac5562e", "signature_version": "v1", "id": "CVE-2024-36927-f02b71fb" }, { "signature_type": "Function", "target": { "function": "raw_sendmsg", "file": "net/ipv4/raw.c" }, "deprecated": false, "digest": { "function_hash": "226187810187555619076594265319293367294", "length": 3563.0 }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fc1092f51567277509563800a3c56732070b6aa4", "signature_version": "v1", "id": "CVE-2024-36927-ff86e695" } ]