CVE-2024-26663

CVE Details

Release Date:

2024-04-02

Description

In the Linux kernel, the following vulnerability has been resolved:\ntipc: Check the bearer type before calling tipc_udp_nl_bearer_add()\nsyzbot reported the following general protection fault [1]:\ngeneral protection fault, probably for non-canonical address 0xdffffc0000000010: 0000 [#1] PREEMPT SMP KASAN\nKASAN: null-ptr-deref in range [0x0000000000000080-0x0000000000000087]\n...\nRIP: 0010:tipc_udp_is_known_peer+0x9c/0x250 net/tipc/udp_media.c:291\n...\nCall Trace:\n\ntipc_udp_nl_bearer_add+0x212/0x2f0 net/tipc/udp_media.c:646\ntipc_nl_bearer_add+0x21e/0x360 net/tipc/bearer.c:1089\ngenl_family_rcv_msg_doit+0x1fc/0x2e0 net/netlink/genetlink.c:972\ngenl_family_rcv_msg net/netlink/genetlink.c:1052 [inline]\ngenl_rcv_msg+0x561/0x800 net/netlink/genetlink.c:1067\nnetlink_rcv_skb+0x16b/0x440 net/netlink/af_netlink.c:2544\ngenl_rcv+0x28/0x40 net/netlink/genetlink.c:1076\nnetlink_unicast_kernel net/netlink/af_netlink.c:1341 [inline]\nnetlink_unicast+0x53b/0x810 net/netlink/af_netlink.c:1367\nnetlink_sendmsg+0x8b7/0xd70 net/netlink/af_netlink.c:1909\nsock_sendmsg_nosec net/socket.c:730 [inline]\n__sock_sendmsg+0xd5/0x180 net/socket.c:745\n____sys_sendmsg+0x6ac/0x940 net/socket.c:2584\n___sys_sendmsg+0x135/0x1d0 net/socket.c:2638\n__sys_sendmsg+0x117/0x1e0 net/socket.c:2667\ndo_syscall_x64 arch/x86/entry/common.c:52 [inline]\ndo_syscall_64+0x40/0x110 arch/x86/entry/common.c:83\nentry_SYSCALL_64_after_hwframe+0x63/0x6b\nThe cause of this issue is that when tipc_nl_bearer_add() is called with\nthe TIPC_NLA_BEARER_UDP_OPTS attribute, tipc_udp_nl_bearer_add() is called\neven if the bearer is not UDP.\ntipc_udp_is_known_peer() called by tipc_udp_nl_bearer_add() assumes that\nthe media_ptr field of the tipc_bearer has an udp_bearer type object, so\nthe function goes crazy for non-UDP bearers.\nThis patch fixes the issue by checking the bearer type before calling\ntipc_udp_nl_bearer_add() in tipc_nl_bearer_add().

See more information about CVE-2024-26663 from MITRE CVE dictionary and NIST NVD

CVSS Scoring

NOTE: The following CVSS v3.1 metrics and score provided are preliminary and subject to review.

Base Score:	5.5	CVSS Vector:	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack Vector:	Local network	Attack Complexity:	Low
Privileges Required:	Low	User Interaction:	None
Scope:	Unchanged	Confidentiality Impact:	None
Integrity Impact:	None	Availability Impact:	High

Errata information

Platform	Errata	Release Date
Oracle Linux version 9 (kernel)	ELSA-2024-9315	2024-11-14