In the Linux kernel, the following vulnerability has been resolved:
net: bridge: xmit: make sure we have at least eth header len bytes
syzbot triggered an uninit value[1] error in bridge device's xmit path by sending a short (less than ETH_HLEN bytes) skb. To fix it check if we can actually pull that amount instead of assuming.
Tested with dropwatch: drop at: brdevxmit+0xb93/0x12d0 [bridge] (0xffffffffc06739b3) origin: software timestamp: Mon May 13 11:31:53 2024 778214037 nsec protocol: 0x88a8 length: 2 original length: 2 drop reason: PKTTOOSMALL
[1] BUG: KMSAN: uninit-value in brdevxmit+0x61d/0x1cb0 net/bridge/brdevice.c:65 brdevxmit+0x61d/0x1cb0 net/bridge/brdevice.c:65 netdevstartxmit include/linux/netdevice.h:4903 [inline] netdevstartxmit include/linux/netdevice.h:4917 [inline] xmitone net/core/dev.c:3531 [inline] devhardstartxmit+0x247/0xa20 net/core/dev.c:3547 _devqueuexmit+0x34db/0x5350 net/core/dev.c:4341 devqueuexmit include/linux/netdevice.h:3091 [inline] _bpftxskb net/core/filter.c:2136 [inline] _bpfredirectcommon net/core/filter.c:2180 [inline] _bpfredirect+0x14a6/0x1620 net/core/filter.c:2187 _bpfcloneredirect net/core/filter.c:2460 [inline] bpfcloneredirect+0x328/0x470 net/core/filter.c:2432 _bpfprogrun+0x13fe/0xe0f0 kernel/bpf/core.c:1997 _bpfprogrun512+0xb5/0xe0 kernel/bpf/core.c:2238 bpfdispatchernopfunc include/linux/bpf.h:1234 [inline] _bpfprogrun include/linux/filter.h:657 [inline] bpfprogrun include/linux/filter.h:664 [inline] bpftestrun+0x499/0xc30 net/bpf/testrun.c:425 bpfprogtestrunskb+0x14ea/0x1f20 net/bpf/testrun.c:1058 bpfprogtestrun+0x6b7/0xad0 kernel/bpf/syscall.c:4269 _sysbpf+0x6aa/0xd90 kernel/bpf/syscall.c:5678 _dosysbpf kernel/bpf/syscall.c:5767 [inline] _sesysbpf kernel/bpf/syscall.c:5765 [inline] _x64sysbpf+0xa0/0xe0 kernel/bpf/syscall.c:5765 x64syscall+0x96b/0x3b50 arch/x86/include/generated/asm/syscalls64.h:322 dosyscallx64 arch/x86/entry/common.c:52 [inline] dosyscall64+0xcf/0x1e0 arch/x86/entry/common.c:83 entrySYSCALL64afterhwframe+0x77/0x7f
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3e01fc3c66e65d9afe98f1489047a1b2dd8741ca",
"signature_type": "Function",
"target": {
"file": "net/bridge/br_device.c",
"function": "br_dev_xmit"
},
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2024-38538-05ec3b1f",
"digest": {
"function_hash": "3587505810320872622801300619535655361",
"length": 2088.0
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5b5d669f569807c7ab07546e73c0741845a2547a",
"signature_type": "Function",
"target": {
"file": "net/bridge/br_device.c",
"function": "br_dev_xmit"
},
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2024-38538-116974db",
"digest": {
"function_hash": "206956270445932958652177068643036732508",
"length": 2245.0
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b2b7c43cd32080221bb233741bd6011983fe7c11",
"signature_type": "Line",
"target": {
"file": "net/bridge/br_device.c"
},
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2024-38538-19b5cdcc",
"digest": {
"line_hashes": [
"265595856268725422224083899073037805431",
"13570799905250628250152857276551406161",
"304176798599250929323275627117762081672"
],
"threshold": 0.9
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f482fd4ce919836a49012b2d31b00fc36e2488f2",
"signature_type": "Function",
"target": {
"file": "net/bridge/br_device.c",
"function": "br_dev_xmit"
},
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2024-38538-1b252afc",
"digest": {
"function_hash": "206956270445932958652177068643036732508",
"length": 2245.0
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8bd67ebb50c0145fd2ca8681ab65eb7e8cde1afc",
"signature_type": "Function",
"target": {
"file": "net/bridge/br_device.c",
"function": "br_dev_xmit"
},
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2024-38538-1c2adf36",
"digest": {
"function_hash": "206956270445932958652177068643036732508",
"length": 2245.0
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@28126b83f86ab9cc7936029c2dff845d3dcedba2",
"signature_type": "Function",
"target": {
"file": "net/bridge/br_device.c",
"function": "br_dev_xmit"
},
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2024-38538-4aa639fb",
"digest": {
"function_hash": "100581425601600237070441427785792066844",
"length": 2192.0
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3e01fc3c66e65d9afe98f1489047a1b2dd8741ca",
"signature_type": "Line",
"target": {
"file": "net/bridge/br_device.c"
},
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2024-38538-4ce4c435",
"digest": {
"line_hashes": [
"265595856268725422224083899073037805431",
"13570799905250628250152857276551406161",
"304176798599250929323275627117762081672"
],
"threshold": 0.9
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5b5d669f569807c7ab07546e73c0741845a2547a",
"signature_type": "Line",
"target": {
"file": "net/bridge/br_device.c"
},
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2024-38538-577f5994",
"digest": {
"line_hashes": [
"172861561618230420584485957173589741440",
"229169363673862367281042549494701013705",
"293708269540368037928150228910784624933",
"24281424674635821934344984534483136311",
"71219742629879624681670254785811150746",
"98924559049807691916041725119097082611",
"71202661530272845667232874210306225820"
],
"threshold": 0.9
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b2b7c43cd32080221bb233741bd6011983fe7c11",
"signature_type": "Function",
"target": {
"file": "net/bridge/br_device.c",
"function": "br_dev_xmit"
},
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2024-38538-5f27998a",
"digest": {
"function_hash": "198743897604880401363980450714082129062",
"length": 2166.0
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c964429ef53f42098a6545a5dabeb1441c1e821d",
"signature_type": "Function",
"target": {
"file": "net/bridge/br_device.c",
"function": "br_dev_xmit"
},
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2024-38538-6b490512",
"digest": {
"function_hash": "100581425601600237070441427785792066844",
"length": 2192.0
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1abb371147905ba250b4cc0230c4be7e90bea4d5",
"signature_type": "Line",
"target": {
"file": "net/bridge/br_device.c"
},
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2024-38538-7d72f24a",
"digest": {
"line_hashes": [
"172861561618230420584485957173589741440",
"229169363673862367281042549494701013705",
"293708269540368037928150228910784624933",
"24281424674635821934344984534483136311",
"71219742629879624681670254785811150746",
"98924559049807691916041725119097082611",
"71202661530272845667232874210306225820"
],
"threshold": 0.9
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@28126b83f86ab9cc7936029c2dff845d3dcedba2",
"signature_type": "Line",
"target": {
"file": "net/bridge/br_device.c"
},
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2024-38538-881792e7",
"digest": {
"line_hashes": [
"172861561618230420584485957173589741440",
"229169363673862367281042549494701013705",
"293708269540368037928150228910784624933",
"24281424674635821934344984534483136311",
"71219742629879624681670254785811150746",
"13570799905250628250152857276551406161",
"304176798599250929323275627117762081672"
],
"threshold": 0.9
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c964429ef53f42098a6545a5dabeb1441c1e821d",
"signature_type": "Line",
"target": {
"file": "net/bridge/br_device.c"
},
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2024-38538-939953a8",
"digest": {
"line_hashes": [
"71219742629879624681670254785811150746",
"13570799905250628250152857276551406161",
"304176798599250929323275627117762081672"
],
"threshold": 0.9
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8bd67ebb50c0145fd2ca8681ab65eb7e8cde1afc",
"signature_type": "Line",
"target": {
"file": "net/bridge/br_device.c"
},
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2024-38538-a12f267e",
"digest": {
"line_hashes": [
"172861561618230420584485957173589741440",
"229169363673862367281042549494701013705",
"293708269540368037928150228910784624933",
"24281424674635821934344984534483136311",
"71219742629879624681670254785811150746",
"98924559049807691916041725119097082611",
"71202661530272845667232874210306225820"
],
"threshold": 0.9
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f482fd4ce919836a49012b2d31b00fc36e2488f2",
"signature_type": "Line",
"target": {
"file": "net/bridge/br_device.c"
},
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2024-38538-abdf2adb",
"digest": {
"line_hashes": [
"172861561618230420584485957173589741440",
"229169363673862367281042549494701013705",
"293708269540368037928150228910784624933",
"24281424674635821934344984534483136311",
"71219742629879624681670254785811150746",
"98924559049807691916041725119097082611",
"71202661530272845667232874210306225820"
],
"threshold": 0.9
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@82090f94c723dab724b1c32db406091d40448a17",
"signature_type": "Function",
"target": {
"file": "net/bridge/br_device.c",
"function": "br_dev_xmit"
},
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2024-38538-e05abf3d",
"digest": {
"function_hash": "257626295185111745857383989895011347198",
"length": 2208.0
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1abb371147905ba250b4cc0230c4be7e90bea4d5",
"signature_type": "Function",
"target": {
"file": "net/bridge/br_device.c",
"function": "br_dev_xmit"
},
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2024-38538-f99bf7b3",
"digest": {
"function_hash": "206956270445932958652177068643036732508",
"length": 2245.0
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@82090f94c723dab724b1c32db406091d40448a17",
"signature_type": "Line",
"target": {
"file": "net/bridge/br_device.c"
},
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2024-38538-fa6ae29f",
"digest": {
"line_hashes": [
"135657784827185413201096909545145338912",
"13570799905250628250152857276551406161",
"304176798599250929323275627117762081672"
],
"threshold": 0.9
}
}
]