CVE-2024-26882

CVE Details

Release Date:

2024-04-17

Description

In the Linux kernel, the following vulnerability has been resolved:\nnet: ip_tunnel: make sure to pull inner header in ip_tunnel_rcv()\nApply the same fix than ones found in :\n8d975c15c0cd ('ip6_tunnel: make sure to pull inner header in __ip6_tnl_rcv()')\n1ca1ba465e55 ('geneve: make sure to pull inner header in geneve_rx()')\nWe have to save skb->network_header in a temporary variable\nin order to be able to recompute the network_header pointer\nafter a pskb_inet_may_pull() call.\npskb_inet_may_pull() makes sure the needed headers are in skb->head.\nsyzbot reported:\nBUG: KMSAN: uninit-value in __INET_ECN_decapsulate include/net/inet_ecn.h:253 [inline]\nBUG: KMSAN: uninit-value in INET_ECN_decapsulate include/net/inet_ecn.h:275 [inline]\nBUG: KMSAN: uninit-value in IP_ECN_decapsulate include/net/inet_ecn.h:302 [inline]\nBUG: KMSAN: uninit-value in ip_tunnel_rcv+0xed9/0x2ed0 net/ipv4/ip_tunnel.c:409\n__INET_ECN_decapsulate include/net/inet_ecn.h:253 [inline]\nINET_ECN_decapsulate include/net/inet_ecn.h:275 [inline]\nIP_ECN_decapsulate include/net/inet_ecn.h:302 [inline]\nip_tunnel_rcv+0xed9/0x2ed0 net/ipv4/ip_tunnel.c:409\n__ipgre_rcv+0x9bc/0xbc0 net/ipv4/ip_gre.c:389\nipgre_rcv net/ipv4/ip_gre.c:411 [inline]\ngre_rcv+0x423/0x19f0 net/ipv4/ip_gre.c:447\ngre_rcv+0x2a4/0x390 net/ipv4/gre_demux.c:163\nip_protocol_deliver_rcu+0x264/0x1300 net/ipv4/ip_input.c:205\nip_local_deliver_finish+0x2b8/0x440 net/ipv4/ip_input.c:233\nNF_HOOK include/linux/netfilter.h:314 [inline]\nip_local_deliver+0x21f/0x490 net/ipv4/ip_input.c:254\ndst_input include/net/dst.h:461 [inline]\nip_rcv_finish net/ipv4/ip_input.c:449 [inline]\nNF_HOOK include/linux/netfilter.h:314 [inline]\nip_rcv+0x46f/0x760 net/ipv4/ip_input.c:569\n__netif_receive_skb_one_core net/core/dev.c:5534 [inline]\n__netif_receive_skb+0x1a6/0x5a0 net/core/dev.c:5648\nnetif_receive_skb_internal net/core/dev.c:5734 [inline]\nnetif_receive_skb+0x58/0x660 net/core/dev.c:5793\ntun_rx_batched+0x3ee/0x980 drivers/net/tun.c:1556\ntun_get_user+0x53b9/0x66e0 drivers/net/tun.c:2009\ntun_chr_write_iter+0x3af/0x5d0 drivers/net/tun.c:2055\ncall_write_iter include/linux/fs.h:2087 [inline]\nnew_sync_write fs/read_write.c:497 [inline]\nvfs_write+0xb6b/0x1520 fs/read_write.c:590\nksys_write+0x20f/0x4c0 fs/read_write.c:643\n__do_sys_write fs/read_write.c:655 [inline]\n__se_sys_write fs/read_write.c:652 [inline]\n__x64_sys_write+0x93/0xd0 fs/read_write.c:652\ndo_syscall_x64 arch/x86/entry/common.c:52 [inline]\ndo_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83\nentry_SYSCALL_64_after_hwframe+0x63/0x6b\nUninit was created at:\n__alloc_pages+0x9a6/0xe00 mm/page_alloc.c:4590\nalloc_pages_mpol+0x62b/0x9d0 mm/mempolicy.c:2133\nalloc_pages+0x1be/0x1e0 mm/mempolicy.c:2204\nskb_page_frag_refill+0x2bf/0x7c0 net/core/sock.c:2909\ntun_build_skb drivers/net/tun.c:1686 [inline]\ntun_get_user+0xe0a/0x66e0 drivers/net/tun.c:1826\ntun_chr_write_iter+0x3af/0x5d0 drivers/net/tun.c:2055\ncall_write_iter include/linux/fs.h:2087 [inline]\nnew_sync_write fs/read_write.c:497 [inline]\nvfs_write+0xb6b/0x1520 fs/read_write.c:590\nksys_write+0x20f/0x4c0 fs/read_write.c:643\n__do_sys_write fs/read_write.c:655 [inline]\n__se_sys_write fs/read_write.c:652 [inline]\n__x64_sys_write+0x93/0xd0 fs/read_write.c:652\ndo_syscall_x64 arch/x86/entry/common.c:52 [inline]\ndo_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83\nentry_SYSCALL_64_after_hwframe+0x63/0x6b

See more information about CVE-2024-26882 from MITRE CVE dictionary and NIST NVD

CVSS Scoring

NOTE: The following CVSS v3.1 metrics and score provided are preliminary and subject to review.

Base Score:	5.5	CVSS Vector:	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack Vector:	Local network	Attack Complexity:	Low
Privileges Required:	Low	User Interaction:	None
Scope:	Unchanged	Confidentiality Impact:	None
Integrity Impact:	None	Availability Impact:	High

Errata information

Platform	Errata	Release Date
Oracle Linux version 9 (kernel)	ELSA-2024-9315	2024-11-14