Release Date: | 2024-06-21 |
In the Linux kernel, the following vulnerability has been resolved:\ntcp: Fix shift-out-of-bounds in dctcp_update_alpha().\nIn dctcp_update_alpha(), we use a module parameter dctcp_shift_g\nas follows:\nalpha -= min_not_zero(alpha, alpha >> dctcp_shift_g);\n...\ndelivered_ce <<= (10 - dctcp_shift_g);\nIt seems syzkaller started fuzzing module parameters and triggered\nshift-out-of-bounds [0] by setting 100 to dctcp_shift_g:\nmemcpy((void*)0x20000080,\n'/sys/module/tcp_dctcp/parameters/dctcp_shift_g\000', 47);\nres = syscall(__NR_openat, /*fd=*/0xffffffffffffff9cul, /*file=*/0x20000080ul,\n/*flags=*/2ul, /*mode=*/0ul);\nmemcpy((void*)0x20000000, '100\000', 4);\nsyscall(__NR_write, /*fd=*/r[0], /*val=*/0x20000000ul, /*len=*/4ul);\nLet's limit the max value of dctcp_shift_g by param_set_uint_minmax().\nWith this patch:\n# echo 10 > /sys/module/tcp_dctcp/parameters/dctcp_shift_g\n# cat /sys/module/tcp_dctcp/parameters/dctcp_shift_g\n10\n# echo 11 > /sys/module/tcp_dctcp/parameters/dctcp_shift_g\n-bash: echo: write error: Invalid argument\n[0]:\nUBSAN: shift-out-of-bounds in net/ipv4/tcp_dctcp.c:143:12\nshift exponent 100 is too large for 32-bit type 'u32' (aka 'unsigned int')\nCPU: 0 PID: 8083 Comm: syz-executor345 Not tainted 6.9.0-05151-g1b294a1f3561 #2\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS\n1.13.0-1ubuntu1.1 04/01/2014\nCall Trace:\n
See more information about CVE-2024-37356 from MITRE CVE dictionary and NIST NVD
NOTE: The following CVSS v3.1 metrics and score provided are preliminary and subject to review.
Base Score: | 6.6 | CVSS Vector: | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H |
Attack Vector: | Local network | Attack Complexity: | Low |
Privileges Required: | Low | User Interaction: | None |
Scope: | Unchanged | Confidentiality Impact: | Low |
Integrity Impact: | Low | Availability Impact: | High |
Platform | Errata | Release Date |
Oracle Linux version 7 (kernel-uek) | ELSA-2024-12581 | 2024-08-12 |
Oracle Linux version 7 (kernel-uek) | ELSA-2024-12611 | 2024-09-11 |
Oracle Linux version 7 (kernel-uek-container) | ELSA-2024-12585 | 2024-08-12 |
Oracle Linux version 8 (kernel-uek) | ELSA-2024-12581 | 2024-08-12 |
Oracle Linux version 8 (kernel-uek-container) | ELSA-2024-12584 | 2024-08-12 |
Oracle Linux version 9 (kernel) | ELSA-2024-5363 | 2024-08-14 |
This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections: