In the Linux kernel, the following vulnerability has been resolved:
dosysnametohandle(): use kzalloc() to fix kernel-infoleak
syzbot identified a kernel information leak vulnerability in dosysnametohandle() and issued the following report [1].
[1] "BUG: KMSAN: kernel-infoleak in instrumentcopytouser include/linux/instrumented.h:114 [inline] BUG: KMSAN: kernel-infoleak in _copytouser+0xbc/0x100 lib/usercopy.c:40 instrumentcopytouser include/linux/instrumented.h:114 [inline] copytouser+0xbc/0x100 lib/usercopy.c:40 copytouser include/linux/uaccess.h:191 [inline] dosysnametohandle fs/fhandle.c:73 [inline] _dosysnametohandleat fs/fhandle.c:112 [inline] _sesysnametohandleat+0x949/0xb10 fs/fhandle.c:94 _x64sysnametohandle_at+0xe4/0x140 fs/fhandle.c:94 ...
Uninit was created at: slabpostallochook+0x129/0xa70 mm/slab.h:768 slaballocnode mm/slub.c:3478 [inline] _kmemcacheallocnode+0x5c9/0x970 mm/slub.c:3517 _dokmallocnode mm/slabcommon.c:1006 [inline] _kmalloc+0x121/0x3c0 mm/slabcommon.c:1020 kmalloc include/linux/slab.h:604 [inline] dosysnametohandle fs/fhandle.c:39 [inline] _dosysnametohandleat fs/fhandle.c:112 [inline] _sesysnametohandleat+0x441/0xb10 fs/fhandle.c:94 _x64sysnametohandle_at+0xe4/0x140 fs/fhandle.c:94 ...
Bytes 18-19 of 20 are uninitialized Memory access of size 20 starts at ffff888128a46380 Data copied to user address 0000000020000240"
Per Chuck Lever's suggestion, use kzalloc() instead of kmalloc() to solve the problem.
[
{
"target": {
"file": "fs/fhandle.c"
},
"digest": {
"line_hashes": [
"150127926637949965488284668418115557403",
"7987552799491130248478504606136602433",
"257501053130846164785378079044591333225",
"1430070228591580471800611510537190890"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cde76b3af247f615447bcfecf610bb76c3529126",
"deprecated": false,
"id": "CVE-2024-26901-05b89078",
"signature_type": "Line",
"signature_version": "v1"
},
{
"target": {
"file": "fs/fhandle.c"
},
"digest": {
"line_hashes": [
"150127926637949965488284668418115557403",
"7987552799491130248478504606136602433",
"257501053130846164785378079044591333225",
"1430070228591580471800611510537190890"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4bac28f441e3cc9d3f1a84c8d023228a68d8a7c1",
"deprecated": false,
"id": "CVE-2024-26901-26cd3577",
"signature_type": "Line",
"signature_version": "v1"
},
{
"target": {
"file": "fs/fhandle.c"
},
"digest": {
"line_hashes": [
"150127926637949965488284668418115557403",
"7987552799491130248478504606136602433",
"257501053130846164785378079044591333225",
"1430070228591580471800611510537190890"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e6450d5e46a737a008b4885aa223486113bf0ad6",
"deprecated": false,
"id": "CVE-2024-26901-322b25ba",
"signature_type": "Line",
"signature_version": "v1"
},
{
"target": {
"file": "fs/fhandle.c"
},
"digest": {
"line_hashes": [
"150127926637949965488284668418115557403",
"7987552799491130248478504606136602433",
"257501053130846164785378079044591333225",
"1430070228591580471800611510537190890"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@772a7def9868091da3bcb0d6c6ff9f0c03d7fa8b",
"deprecated": false,
"id": "CVE-2024-26901-4f189151",
"signature_type": "Line",
"signature_version": "v1"
},
{
"target": {
"file": "fs/fhandle.c"
},
"digest": {
"line_hashes": [
"150127926637949965488284668418115557403",
"7987552799491130248478504606136602433",
"257501053130846164785378079044591333225",
"1430070228591580471800611510537190890"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cba138f1ef37ec6f961baeab62f312dedc7cf730",
"deprecated": false,
"id": "CVE-2024-26901-59c9f08c",
"signature_type": "Line",
"signature_version": "v1"
},
{
"target": {
"file": "fs/fhandle.c"
},
"digest": {
"line_hashes": [
"150127926637949965488284668418115557403",
"7987552799491130248478504606136602433",
"257501053130846164785378079044591333225",
"1430070228591580471800611510537190890"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3948abaa4e2be938ccdfc289385a27342fb13d43",
"deprecated": false,
"id": "CVE-2024-26901-86c47725",
"signature_type": "Line",
"signature_version": "v1"
},
{
"target": {
"file": "fs/fhandle.c"
},
"digest": {
"line_hashes": [
"150127926637949965488284668418115557403",
"7987552799491130248478504606136602433",
"257501053130846164785378079044591333225",
"1430070228591580471800611510537190890"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bf9ec1b24ab4e94345aa1c60811dd329f069c38b",
"deprecated": false,
"id": "CVE-2024-26901-998f67aa",
"signature_type": "Line",
"signature_version": "v1"
},
{
"target": {
"file": "fs/fhandle.c"
},
"digest": {
"line_hashes": [
"150127926637949965488284668418115557403",
"7987552799491130248478504606136602433",
"257501053130846164785378079044591333225",
"1430070228591580471800611510537190890"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@423b6bdf19bbc5e1f7e7461045099917378f7e71",
"deprecated": false,
"id": "CVE-2024-26901-c6fbd0ba",
"signature_type": "Line",
"signature_version": "v1"
},
{
"target": {
"file": "fs/fhandle.c"
},
"digest": {
"line_hashes": [
"150127926637949965488284668418115557403",
"7987552799491130248478504606136602433",
"257501053130846164785378079044591333225",
"1430070228591580471800611510537190890"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c1362eae861db28b1608b9dc23e49634fe87b63b",
"deprecated": false,
"id": "CVE-2024-26901-e569119b",
"signature_type": "Line",
"signature_version": "v1"
}
]