CVE-2024-50110

CVE Details

Release Date:

2024-11-05

Description

In the Linux kernel, the following vulnerability has been resolved:\nxfrm: fix one more kernel-infoleak in algo dumping\nDuring fuzz testing, the following issue was discovered:\nBUG: KMSAN: kernel-infoleak in _copy_to_iter+0x598/0x2a30\n_copy_to_iter+0x598/0x2a30\n__skb_datagram_iter+0x168/0x1060\nskb_copy_datagram_iter+0x5b/0x220\nnetlink_recvmsg+0x362/0x1700\nsock_recvmsg+0x2dc/0x390\n__sys_recvfrom+0x381/0x6d0\n__x64_sys_recvfrom+0x130/0x200\nx64_sys_call+0x32c8/0x3cc0\ndo_syscall_64+0xd8/0x1c0\nentry_SYSCALL_64_after_hwframe+0x79/0x81\nUninit was stored to memory at:\ncopy_to_user_state_extra+0xcc1/0x1e00\ndump_one_state+0x28c/0x5f0\nxfrm_state_walk+0x548/0x11e0\nxfrm_dump_sa+0x1e0/0x840\nnetlink_dump+0x943/0x1c40\n__netlink_dump_start+0x746/0xdb0\nxfrm_user_rcv_msg+0x429/0xc00\nnetlink_rcv_skb+0x613/0x780\nxfrm_netlink_rcv+0x77/0xc0\nnetlink_unicast+0xe90/0x1280\nnetlink_sendmsg+0x126d/0x1490\n__sock_sendmsg+0x332/0x3d0\n____sys_sendmsg+0x863/0xc30\n___sys_sendmsg+0x285/0x3e0\n__x64_sys_sendmsg+0x2d6/0x560\nx64_sys_call+0x1316/0x3cc0\ndo_syscall_64+0xd8/0x1c0\nentry_SYSCALL_64_after_hwframe+0x79/0x81\nUninit was created at:\n__kmalloc+0x571/0xd30\nattach_auth+0x106/0x3e0\nxfrm_add_sa+0x2aa0/0x4230\nxfrm_user_rcv_msg+0x832/0xc00\nnetlink_rcv_skb+0x613/0x780\nxfrm_netlink_rcv+0x77/0xc0\nnetlink_unicast+0xe90/0x1280\nnetlink_sendmsg+0x126d/0x1490\n__sock_sendmsg+0x332/0x3d0\n____sys_sendmsg+0x863/0xc30\n___sys_sendmsg+0x285/0x3e0\n__x64_sys_sendmsg+0x2d6/0x560\nx64_sys_call+0x1316/0x3cc0\ndo_syscall_64+0xd8/0x1c0\nentry_SYSCALL_64_after_hwframe+0x79/0x81\nBytes 328-379 of 732 are uninitialized\nMemory access of size 732 starts at ffff88800e18e000\nData copied to user address 00007ff30f48aff0\nCPU: 2 PID: 18167 Comm: syz-executor.0 Not tainted 6.8.11 #1\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014\nFixes copying of xfrm algorithms where some random\ndata of the structure fields can end up in userspace.\nPadding in structures may be filled with random (possibly sensitve)\ndata and should never be given directly to user-space.\nA similar issue was resolved in the commit\n8222d5910dae ('xfrm: Zero padding when dumping algos and encap')\nFound by Linux Verification Center (linuxtesting.org) with Syzkaller.

See more information about CVE-2024-50110 from MITRE CVE dictionary and NIST NVD

NOTE: The following CVSS metrics and score provided are preliminary and subject to review.

CVSS v3 metrics

Base Score:	5.5
Vector String:	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Version:	3.1
Attack Vector:	Local
Attack Complexity:	Low
Privileges Required:	Low
User Interaction:	None
Scope:	Unchanged
Confidentiality:	None
Integrity:	None
Availability:	High

Errata information

Platform	Errata	Release Date
Oracle Linux version 8 (kernel)	ELSA-2024-10943	2024-12-11