In the Linux kernel, the following vulnerability has been resolved: netfilter: nfconncount: Fully initialize struct nfconncounttuple in inserttree() Since commit b36e4523d4d5 ("netfilter: nfconncount: fix garbage collection confirm race"), cpu
and jiffies32
were introduced to the struct nfconncounttuple. The commit made nfconncountadd() initialize conn->cpu
and conn->jiffies32
when allocating the struct. In contrast, counttree() was not changed to initialize them. By commit 34848d5c896e ("netfilter: nfconncount: Split insert and traversal"), counttree() was split and the relevant allocation code now resides in inserttree(). Initialize conn->cpu
and conn->jiffies32
in inserttree(). BUG: KMSAN: uninit-value in findorevict net/netfilter/nfconncount.c:117 [inline] BUG: KMSAN: uninit-value in _nfconncountadd+0xd9c/0x2850 net/netfilter/nfconncount.c:143 findorevict net/netfilter/nfconncount.c:117 [inline] _nfconncountadd+0xd9c/0x2850 net/netfilter/nfconncount.c:143 counttree net/netfilter/nfconncount.c:438 [inline] nfconncountcount+0x82f/0x1e80 net/netfilter/nfconncount.c:521 connlimitmt+0x7f6/0xbd0 net/netfilter/xtconnlimit.c:72 _nftmatcheval net/netfilter/nftcompat.c:403 [inline] nftmatcheval+0x1a5/0x300 net/netfilter/nftcompat.c:433 exprcallopseval net/netfilter/nftablescore.c:240 [inline] nftdochain+0x426/0x2290 net/netfilter/nftablescore.c:288 nftdochainipv4+0x1a5/0x230 net/netfilter/nftchainfilter.c:23 nfhookentryhookfn include/linux/netfilter.h:154 [inline] nfhookslow+0xf4/0x400 net/netfilter/core.c:626 nfhookslowlist+0x24d/0x860 net/netfilter/core.c:663 NFHOOKLIST include/linux/netfilter.h:350 [inline] ipsublistrcv+0x17b7/0x17f0 net/ipv4/ipinput.c:633 iplistrcv+0x9ef/0xa40 net/ipv4/ipinput.c:669 _netifreceiveskblistptype net/core/dev.c:5936 [inline] _netifreceiveskblistcore+0x15c5/0x1670 net/core/dev.c:5983 _netifreceiveskblist net/core/dev.c:6035 [inline] netifreceiveskblistinternal+0x1085/0x1700 net/core/dev.c:6126 netifreceiveskblist+0x5a/0x460 net/core/dev.c:6178 xdprecvframes net/bpf/testrun.c:280 [inline] xdptestrunbatch net/bpf/testrun.c:361 [inline] bpftestrunxdplive+0x2e86/0x3480 net/bpf/testrun.c:390 bpfprogtestrunxdp+0xf1d/0x1ae0 net/bpf/testrun.c:1316 bpfprogtestrun+0x5e5/0xa30 kernel/bpf/syscall.c:4407 _sysbpf+0x6aa/0xd90 kernel/bpf/syscall.c:5813 _dosysbpf kernel/bpf/syscall.c:5902 [inline] _sesysbpf kernel/bpf/syscall.c:5900 [inline] _ia32sysbpf+0xa0/0xe0 kernel/bpf/syscall.c:5900 ia32syscall+0x394d/0x4180 arch/x86/include/generated/asm/syscalls32.h:358 dosyscall32irqson arch/x86/entry/common.c:165 [inline] _dofastsyscall32+0xb0/0x110 arch/x86/entry/common.c:387 dofastsyscall32+0x38/0x80 arch/x86/entry/common.c:412 doSYSENTER32+0x1f/0x30 arch/x86/entry/common.c:450 entrySYSENTERcompatafterhwframe+0x84/0x8e Uninit was created at: slabpostallochook mm/slub.c:4121 [inline] slaballocnode mm/slub.c:4164 [inline] kmemcacheallocnoprof+0x915/0xe10 mm/slub.c:4171 inserttree net/netfilter/nfconncount.c:372 [inline] counttree net/netfilter/nfconncount.c:450 [inline] nfconncountcount+0x1415/0x1e80 net/netfilter/nfconncount.c:521 connlimitmt+0x7f6/0xbd0 net/netfilter/xtconnlimit.c:72 _nftmatcheval net/netfilter/nftcompat.c:403 [inline] nftmatcheval+0x1a5/0x300 net/netfilter/nftcompat.c:433 exprcallopseval net/netfilter/nftablescore.c:240 [inline] nftdochain+0x426/0x2290 net/netfilter/nftablescore.c:288 nftdochainipv4+0x1a5/0x230 net/netfilter/nftchainfilter.c:23 nfhookentryhookfn include/linux/netfilter.h:154 [inline] nfhookslow+0xf4/0x400 net/netfilter/core.c:626 nfhookslowlist+0x24d/0x860 net/netfilter/core.c:663 NFHOOKLIST include/linux/netfilter.h:350 [inline] ipsublistrcv+0x17b7/0x17f0 net/ipv4/ipinput.c:633 iplist_rcv+0x9ef/0xa40 net/ip ---truncated---
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "binary_version": "7.6.0+6.14.0-11.11", "binary_name": "bpftool" }, { "binary_version": "6.14.0-11.11", "binary_name": "linux-bpf-dev" }, { "binary_version": "6.14.0-11.11", "binary_name": "linux-buildinfo-6.14.0-11-generic" }, { "binary_version": "6.14.0-11.11", "binary_name": "linux-buildinfo-6.14.0-11-generic-64k" }, { "binary_version": "6.14.0-11.11", "binary_name": "linux-cloud-tools-6.14.0-11" }, { "binary_version": "6.14.0-11.11", "binary_name": "linux-cloud-tools-6.14.0-11-generic" }, { "binary_version": "6.14.0-11.11", "binary_name": "linux-cloud-tools-common" }, { "binary_version": "6.14.0-11.11", "binary_name": "linux-doc" }, { "binary_version": "6.14.0-11.11", "binary_name": "linux-headers-6.14.0-11" }, { "binary_version": "6.14.0-11.11", "binary_name": "linux-headers-6.14.0-11-generic" }, { "binary_version": "6.14.0-11.11", "binary_name": "linux-headers-6.14.0-11-generic-64k" }, { "binary_version": "6.14.0-11.11", "binary_name": "linux-image-6.14.0-11-generic" }, { "binary_version": "6.14.0-11.11", "binary_name": "linux-image-6.14.0-11-generic-dbgsym" }, { "binary_version": "6.14.0-11.11", "binary_name": "linux-image-unsigned-6.14.0-11-generic" }, { "binary_version": "6.14.0-11.11", "binary_name": "linux-image-unsigned-6.14.0-11-generic-64k" }, { "binary_version": "6.14.0-11.11", "binary_name": "linux-image-unsigned-6.14.0-11-generic-64k-dbgsym" }, { "binary_version": "6.14.0-11.11", "binary_name": "linux-image-unsigned-6.14.0-11-generic-dbgsym" }, { "binary_version": "6.14.0-11.11", "binary_name": "linux-lib-rust-6.14.0-11-generic" }, { "binary_version": "6.14.0-11.11", "binary_name": "linux-libc-dev" }, { "binary_version": "6.14.0-11.11", "binary_name": "linux-modules-6.14.0-11-generic" }, { "binary_version": "6.14.0-11.11", "binary_name": "linux-modules-6.14.0-11-generic-64k" }, { "binary_version": "6.14.0-11.11", "binary_name": "linux-modules-extra-6.14.0-11-generic" }, { "binary_version": "6.14.0-11.11", "binary_name": "linux-modules-ipu6-6.14.0-11-generic" }, { "binary_version": "6.14.0-11.11", "binary_name": "linux-modules-ipu7-6.14.0-11-generic" }, { "binary_version": "6.14.0-11.11", "binary_name": "linux-modules-iwlwifi-6.14.0-11-generic" }, { "binary_version": "6.14.0-11.11", "binary_name": "linux-modules-usbio-6.14.0-11-generic" }, { "binary_version": "6.14.0-11.11", "binary_name": "linux-modules-vision-6.14.0-11-generic" }, { "binary_version": "6.14.0-11.11", "binary_name": "linux-perf" }, { "binary_version": "6.14.0-11.11", "binary_name": "linux-source-6.14.0" }, { "binary_version": "6.14.0-11.11", "binary_name": "linux-tools-6.14.0-11" }, { "binary_version": "6.14.0-11.11", "binary_name": "linux-tools-6.14.0-11-generic" }, { "binary_version": "6.14.0-11.11", "binary_name": "linux-tools-6.14.0-11-generic-64k" }, { "binary_version": "6.14.0-11.11", "binary_name": "linux-tools-common" }, { "binary_version": "6.14.0-11.11", "binary_name": "linux-tools-host" } ] }
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "binary_version": "6.14.0-1004.4", "binary_name": "linux-aws-cloud-tools-6.14.0-1004" }, { "binary_version": "6.14.0-1004.4", "binary_name": "linux-aws-headers-6.14.0-1004" }, { "binary_version": "6.14.0-1004.4", "binary_name": "linux-aws-tools-6.14.0-1004" }, { "binary_version": "6.14.0-1004.4", "binary_name": "linux-buildinfo-6.14.0-1004-aws" }, { "binary_version": "6.14.0-1004.4", "binary_name": "linux-cloud-tools-6.14.0-1004-aws" }, { "binary_version": "6.14.0-1004.4", "binary_name": "linux-headers-6.14.0-1004-aws" }, { "binary_version": "6.14.0-1004.4", "binary_name": "linux-image-unsigned-6.14.0-1004-aws" }, { "binary_version": "6.14.0-1004.4", "binary_name": "linux-image-unsigned-6.14.0-1004-aws-dbgsym" }, { "binary_version": "6.14.0-1004.4", "binary_name": "linux-modules-6.14.0-1004-aws" }, { "binary_version": "6.14.0-1004.4", "binary_name": "linux-modules-extra-6.14.0-1004-aws" }, { "binary_version": "6.14.0-1004.4", "binary_name": "linux-tools-6.14.0-1004-aws" } ] }
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "binary_version": "6.14.0-1003.3", "binary_name": "linux-azure-cloud-tools-6.14.0-1003" }, { "binary_version": "6.14.0-1003.3", "binary_name": "linux-azure-headers-6.14.0-1003" }, { "binary_version": "6.14.0-1003.3", "binary_name": "linux-azure-tools-6.14.0-1003" }, { "binary_version": "6.14.0-1003.3", "binary_name": "linux-buildinfo-6.14.0-1003-azure" }, { "binary_version": "6.14.0-1003.3", "binary_name": "linux-cloud-tools-6.14.0-1003-azure" }, { "binary_version": "6.14.0-1003.3", "binary_name": "linux-headers-6.14.0-1003-azure" }, { "binary_version": "6.14.0-1003.3", "binary_name": "linux-image-unsigned-6.14.0-1003-azure" }, { "binary_version": "6.14.0-1003.3", "binary_name": "linux-image-unsigned-6.14.0-1003-azure-dbgsym" }, { "binary_version": "6.14.0-1003.3", "binary_name": "linux-modules-6.14.0-1003-azure" }, { "binary_version": "6.14.0-1003.3", "binary_name": "linux-modules-extra-6.14.0-1003-azure" }, { "binary_version": "6.14.0-1003.3", "binary_name": "linux-tools-6.14.0-1003-azure" } ] }
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "binary_version": "6.14.0-1003.3", "binary_name": "linux-buildinfo-6.14.0-1003-gcp" }, { "binary_version": "6.14.0-1003.3", "binary_name": "linux-buildinfo-6.14.0-1003-gcp-64k" }, { "binary_version": "6.14.0-1003.3", "binary_name": "linux-gcp-headers-6.14.0-1003" }, { "binary_version": "6.14.0-1003.3", "binary_name": "linux-gcp-tools-6.14.0-1003" }, { "binary_version": "6.14.0-1003.3", "binary_name": "linux-headers-6.14.0-1003-gcp" }, { "binary_version": "6.14.0-1003.3", "binary_name": "linux-headers-6.14.0-1003-gcp-64k" }, { "binary_version": "6.14.0-1003.3", "binary_name": "linux-image-unsigned-6.14.0-1003-gcp" }, { "binary_version": "6.14.0-1003.3", "binary_name": "linux-image-unsigned-6.14.0-1003-gcp-64k" }, { "binary_version": "6.14.0-1003.3", "binary_name": "linux-image-unsigned-6.14.0-1003-gcp-64k-dbgsym" }, { "binary_version": "6.14.0-1003.3", "binary_name": "linux-image-unsigned-6.14.0-1003-gcp-dbgsym" }, { "binary_version": "6.14.0-1003.3", "binary_name": "linux-modules-6.14.0-1003-gcp" }, { "binary_version": "6.14.0-1003.3", "binary_name": "linux-modules-6.14.0-1003-gcp-64k" }, { "binary_version": "6.14.0-1003.3", "binary_name": "linux-modules-extra-6.14.0-1003-gcp" }, { "binary_version": "6.14.0-1003.3", "binary_name": "linux-modules-extra-6.14.0-1003-gcp-64k" }, { "binary_version": "6.14.0-1003.3", "binary_name": "linux-tools-6.14.0-1003-gcp" }, { "binary_version": "6.14.0-1003.3", "binary_name": "linux-tools-6.14.0-1003-gcp-64k" } ] }
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "binary_version": "6.14.0-1003.3", "binary_name": "linux-buildinfo-6.14.0-1003-oracle" }, { "binary_version": "6.14.0-1003.3", "binary_name": "linux-buildinfo-6.14.0-1003-oracle-64k" }, { "binary_version": "6.14.0-1003.3", "binary_name": "linux-headers-6.14.0-1003-oracle" }, { "binary_version": "6.14.0-1003.3", "binary_name": "linux-headers-6.14.0-1003-oracle-64k" }, { "binary_version": "6.14.0-1003.3", "binary_name": "linux-image-unsigned-6.14.0-1003-oracle" }, { "binary_version": "6.14.0-1003.3", "binary_name": "linux-image-unsigned-6.14.0-1003-oracle-64k" }, { "binary_version": "6.14.0-1003.3", "binary_name": "linux-image-unsigned-6.14.0-1003-oracle-64k-dbgsym" }, { "binary_version": "6.14.0-1003.3", "binary_name": "linux-image-unsigned-6.14.0-1003-oracle-dbgsym" }, { "binary_version": "6.14.0-1003.3", "binary_name": "linux-modules-6.14.0-1003-oracle" }, { "binary_version": "6.14.0-1003.3", "binary_name": "linux-modules-6.14.0-1003-oracle-64k" }, { "binary_version": "6.14.0-1003.3", "binary_name": "linux-modules-extra-6.14.0-1003-oracle" }, { "binary_version": "6.14.0-1003.3", "binary_name": "linux-modules-extra-6.14.0-1003-oracle-64k" }, { "binary_version": "6.14.0-1003.3", "binary_name": "linux-oracle-headers-6.14.0-1003" }, { "binary_version": "6.14.0-1003.3", "binary_name": "linux-oracle-tools-6.14.0-1003" }, { "binary_version": "6.14.0-1003.3", "binary_name": "linux-tools-6.14.0-1003-oracle" }, { "binary_version": "6.14.0-1003.3", "binary_name": "linux-tools-6.14.0-1003-oracle-64k" } ] }
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "binary_version": "6.14.0-1004.4", "binary_name": "linux-buildinfo-6.14.0-1004-raspi" }, { "binary_version": "6.14.0-1004.4", "binary_name": "linux-headers-6.14.0-1004-raspi" }, { "binary_version": "6.14.0-1004.4", "binary_name": "linux-image-6.14.0-1004-raspi" }, { "binary_version": "6.14.0-1004.4", "binary_name": "linux-image-6.14.0-1004-raspi-dbgsym" }, { "binary_version": "6.14.0-1004.4", "binary_name": "linux-modules-6.14.0-1004-raspi" }, { "binary_version": "6.14.0-1004.4", "binary_name": "linux-raspi-headers-6.14.0-1004" }, { "binary_version": "6.14.0-1004.4", "binary_name": "linux-raspi-tools-6.14.0-1004" }, { "binary_version": "6.14.0-1004.4", "binary_name": "linux-tools-6.14.0-1004-raspi" } ] }
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "binary_version": "6.14.0-1002.2", "binary_name": "linux-buildinfo-6.14.0-1002-realtime" }, { "binary_version": "6.14.0-1002.2", "binary_name": "linux-cloud-tools-6.14.0-1002-realtime" }, { "binary_version": "6.14.0-1002.2", "binary_name": "linux-headers-6.14.0-1002-realtime" }, { "binary_version": "6.14.0-1002.2", "binary_name": "linux-image-unsigned-6.14.0-1002-realtime" }, { "binary_version": "6.14.0-1002.2", "binary_name": "linux-image-unsigned-6.14.0-1002-realtime-dbgsym" }, { "binary_version": "6.14.0-1002.2", "binary_name": "linux-modules-6.14.0-1002-realtime" }, { "binary_version": "6.14.0-1002.2", "binary_name": "linux-modules-extra-6.14.0-1002-realtime" }, { "binary_version": "6.14.0-1002.2", "binary_name": "linux-modules-iwlwifi-6.14.0-1002-realtime" }, { "binary_version": "6.14.0-1002.2", "binary_name": "linux-realtime-cloud-tools-6.14.0-1002" }, { "binary_version": "6.14.0-1002.2", "binary_name": "linux-realtime-headers-6.14.0-1002" }, { "binary_version": "6.14.0-1002.2", "binary_name": "linux-realtime-tools-6.14.0-1002" }, { "binary_version": "6.14.0-1002.2", "binary_name": "linux-tools-6.14.0-1002-realtime" } ] }
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "binary_version": "6.14.0-11.11.1", "binary_name": "linux-buildinfo-6.14.0-11-generic" }, { "binary_version": "6.14.0-11.11.1", "binary_name": "linux-headers-6.14.0-11-generic" }, { "binary_version": "6.14.0-11.11.1", "binary_name": "linux-image-6.14.0-11-generic" }, { "binary_version": "6.14.0-11.11.1", "binary_name": "linux-image-6.14.0-11-generic-dbgsym" }, { "binary_version": "6.14.0-11.11.1", "binary_name": "linux-modules-6.14.0-11-generic" }, { "binary_version": "6.14.0-11.11.1", "binary_name": "linux-riscv-headers-6.14.0-11" }, { "binary_version": "6.14.0-11.11.1", "binary_name": "linux-riscv-tools-6.14.0-11" }, { "binary_version": "6.14.0-11.11.1", "binary_name": "linux-tools-6.14.0-11-generic" } ] }