CVE-2024-26663

See a problem?
Source
https://nvd.nist.gov/vuln/detail/CVE-2024-26663
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-26663.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-26663
Related
Published
2024-04-02T07:15:43Z
Modified
2024-09-11T05:03:26.799813Z
Summary
[none]
Details

In the Linux kernel, the following vulnerability has been resolved:

tipc: Check the bearer type before calling tipcudpnlbeareradd()

syzbot reported the following general protection fault [1]:

general protection fault, probably for non-canonical address 0xdffffc0000000010: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000080-0x0000000000000087] ... RIP: 0010:tipcudpisknownpeer+0x9c/0x250 net/tipc/udpmedia.c:291 ... Call Trace: <TASK> tipcudpnlbeareradd+0x212/0x2f0 net/tipc/udpmedia.c:646 tipcnlbeareradd+0x21e/0x360 net/tipc/bearer.c:1089 genlfamilyrcvmsgdoit+0x1fc/0x2e0 net/netlink/genetlink.c:972 genlfamilyrcvmsg net/netlink/genetlink.c:1052 [inline] genlrcvmsg+0x561/0x800 net/netlink/genetlink.c:1067 netlinkrcvskb+0x16b/0x440 net/netlink/afnetlink.c:2544 genlrcv+0x28/0x40 net/netlink/genetlink.c:1076 netlinkunicastkernel net/netlink/afnetlink.c:1341 [inline] netlinkunicast+0x53b/0x810 net/netlink/afnetlink.c:1367 netlinksendmsg+0x8b7/0xd70 net/netlink/afnetlink.c:1909 socksendmsgnosec net/socket.c:730 [inline] socksendmsg+0xd5/0x180 net/socket.c:745 syssendmsg+0x6ac/0x940 net/socket.c:2584 _syssendmsg+0x135/0x1d0 net/socket.c:2638 _syssendmsg+0x117/0x1e0 net/socket.c:2667 dosyscallx64 arch/x86/entry/common.c:52 [inline] dosyscall64+0x40/0x110 arch/x86/entry/common.c:83 entrySYSCALL64afterhwframe+0x63/0x6b

The cause of this issue is that when tipcnlbeareradd() is called with the TIPCNLABEARERUDPOPTS attribute, tipcudpnlbearer_add() is called even if the bearer is not UDP.

tipcudpisknownpeer() called by tipcudpnlbeareradd() assumes that the mediaptr field of the tipcbearer has an udp_bearer type object, so the function goes crazy for non-UDP bearers.

This patch fixes the issue by checking the bearer type before calling tipcudpnlbeareradd() in tipcnlbearer_add().

References

Affected packages

Debian:11 / linux

Package

Name
linux
Purl
pkg:deb/debian/linux?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
5.10.216-1

Affected versions

5.*

5.10.46-4
5.10.46-5
5.10.70-1~bpo10+1
5.10.70-1
5.10.84-1
5.10.92-1~bpo10+1
5.10.92-1
5.10.92-2
5.10.103-1~bpo10+1
5.10.103-1
5.10.106-1
5.10.113-1
5.10.120-1~bpo10+1
5.10.120-1
5.10.127-1
5.10.127-2~bpo10+1
5.10.127-2
5.10.136-1
5.10.140-1
5.10.148-1
5.10.149-1
5.10.149-2
5.10.158-1
5.10.158-2
5.10.162-1
5.10.178-1
5.10.178-2
5.10.178-3
5.10.179-1
5.10.179-2
5.10.179-3
5.10.179-4
5.10.179-5
5.10.191-1
5.10.197-1
5.10.205-1
5.10.205-2
5.10.209-1
5.10.209-2

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:12 / linux

Package

Name
linux
Purl
pkg:deb/debian/linux?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
6.1.82-1

Affected versions

6.*

6.1.27-1
6.1.37-1
6.1.38-1
6.1.38-2~bpo11+1
6.1.38-2
6.1.38-3
6.1.38-4~bpo11+1
6.1.38-4
6.1.52-1
6.1.55-1~bpo11+1
6.1.55-1
6.1.64-1
6.1.66-1
6.1.67-1
6.1.69-1~bpo11+1
6.1.69-1
6.1.76-1~bpo11+1
6.1.76-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:13 / linux

Package

Name
linux
Purl
pkg:deb/debian/linux?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
6.7.7-1

Affected versions

6.*

6.1.27-1
6.1.37-1
6.1.38-1
6.1.38-2~bpo11+1
6.1.38-2
6.1.38-3
6.1.38-4~bpo11+1
6.1.38-4
6.1.52-1
6.1.55-1~bpo11+1
6.1.55-1
6.1.64-1
6.1.66-1
6.1.67-1
6.1.69-1~bpo11+1
6.1.69-1
6.1.76-1~bpo11+1
6.1.76-1
6.1.82-1
6.1.85-1
6.1.90-1~bpo11+1
6.1.90-1
6.1.94-1~bpo11+1
6.1.94-1
6.1.98-1
6.1.99-1
6.1.106-1
6.1.106-2
6.1.106-3
6.3.1-1~exp1
6.3.2-1~exp1
6.3.4-1~exp1
6.3.5-1~exp1
6.3.7-1~bpo12+1
6.3.7-1
6.3.11-1
6.4~rc6-1~exp1
6.4~rc7-1~exp1
6.4.1-1~exp1
6.4.4-1~bpo12+1
6.4.4-1
6.4.4-2
6.4.4-3~bpo12+1
6.4.4-3
6.4.11-1
6.4.13-1
6.5~rc4-1~exp1
6.5~rc6-1~exp1
6.5~rc7-1~exp1
6.5.1-1~exp1
6.5.3-1~bpo12+1
6.5.3-1
6.5.6-1
6.5.8-1
6.5.10-1~bpo12+1
6.5.10-1
6.5.13-1
6.6.3-1~exp1
6.6.4-1~exp1
6.6.7-1~exp1
6.6.8-1
6.6.9-1
6.6.11-1
6.6.13-1~bpo12+1
6.6.13-1
6.6.15-1
6.6.15-2
6.7-1~exp1
6.7.1-1~exp1
6.7.4-1~exp1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}