Description

In the Linux kernel, the following vulnerability has been resolved: ppp: fix ppp_async_encode() illegal access syzbot reported an issue in ppp_async_encode() [1] In this case, pppoe_sendmsg() is called with a zero size. Then ppp_async_encode() is called with an empty skb. BUG: KMSAN: uninit-value in ppp_async_encode drivers/net/ppp/ppp_async.c:545 [inline] BUG: KMSAN: uninit-value in ppp_async_push+0xb4f/0x2660 drivers/net/ppp/ppp_async.c:675 ppp_async_encode drivers/net/ppp/ppp_async.c:545 [inline] ppp_async_push+0xb4f/0x2660 drivers/net/ppp/ppp_async.c:675 ppp_async_send+0x130/0x1b0 drivers/net/ppp/ppp_async.c:634 ppp_channel_bridge_input drivers/net/ppp/ppp_generic.c:2280 [inline] ppp_input+0x1f1/0xe60 drivers/net/ppp/ppp_generic.c:2304 pppoe_rcv_core+0x1d3/0x720 drivers/net/ppp/pppoe.c:379 sk_backlog_rcv+0x13b/0x420 include/net/sock.h:1113 __release_sock+0x1da/0x330 net/core/sock.c:3072 release_sock+0x6b/0x250 net/core/sock.c:3626 pppoe_sendmsg+0x2b8/0xb90 drivers/net/ppp/pppoe.c:903 sock_sendmsg_nosec net/socket.c:729 [inline] __sock_sendmsg+0x30f/0x380 net/socket.c:744 ____sys_sendmsg+0x903/0xb60 net/socket.c:2602 ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2656 __sys_sendmmsg+0x3c1/0x960 net/socket.c:2742 __do_sys_sendmmsg net/socket.c:2771 [inline] __se_sys_sendmmsg net/socket.c:2768 [inline] __x64_sys_sendmmsg+0xbc/0x120 net/socket.c:2768 x64_sys_call+0xb6e/0x3ba0 arch/x86/include/generated/asm/syscalls_64.h:308 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Uninit was created at: slab_post_alloc_hook mm/slub.c:4092 [inline] slab_alloc_node mm/slub.c:4135 [inline] kmem_cache_alloc_node_noprof+0x6bf/0xb80 mm/slub.c:4187 kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:587 __alloc_skb+0x363/0x7b0 net/core/skbuff.c:678 alloc_skb include/linux/skbuff.h:1322 [inline] sock_wmalloc+0xfe/0x1a0 net/core/sock.c:2732 pppoe_sendmsg+0x3a7/0xb90 drivers/net/ppp/pppoe.c:867 sock_sendmsg_nosec net/socket.c:729 [inline] __sock_sendmsg+0x30f/0x380 net/socket.c:744 ____sys_sendmsg+0x903/0xb60 net/socket.c:2602 ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2656 __sys_sendmmsg+0x3c1/0x960 net/socket.c:2742 __do_sys_sendmmsg net/socket.c:2771 [inline] __se_sys_sendmmsg net/socket.c:2768 [inline] __x64_sys_sendmmsg+0xbc/0x120 net/socket.c:2768 x64_sys_call+0xb6e/0x3ba0 arch/x86/include/generated/asm/syscalls_64.h:308 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f CPU: 1 UID: 0 PID: 5411 Comm: syz.1.14 Not tainted 6.12.0-rc1-syzkaller-00165-g360c1f1f24c6 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024

Metrics

 

CVSS Version 4.0 CVSS Version 3.x CVSS Version 2.0

NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed.

CVSS 4.0 Severity and Vector Strings:

NIST: NVD

N/A

NVD assessment not yet provided.

CVSS 3.x Severity and Vector Strings:

NIST: NVD

Base Score:  7.1 HIGH

Vector:  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

CVSS 2.0 Severity and Vector Strings:

NIST: NVD

Base Score: N/A

NVD assessment not yet provided.

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

Hyperlink	Resource
https://git.kernel.org/stable/c/30d91a478d58cbae3dbaa8224d17d0d839f0d71b	Patch
https://git.kernel.org/stable/c/40dddd4b8bd08a69471efd96107a4e1c73fabefc	Patch
https://git.kernel.org/stable/c/8fe992ff3df493d1949922ca234419f3ede08dff	Patch
https://git.kernel.org/stable/c/c007a14797240607038bd3464501109f408940e2	Patch
https://git.kernel.org/stable/c/ce249a4c68d0ce27a8c5d853338d502e2711a314	Patch
https://git.kernel.org/stable/c/fadf8fdb3110d3138e05c3765f645535434f8d76	Patch

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-908	Use of Uninitialized Resource	NIST

Known Affected Software Configurations Switch to CPE 2.2

CPEs loading, please wait.

Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.

Change History

2 change records found show changes

Initial Analysis by NIST 10/24/2024 3:54:02 PM

Action	Type	Old Value	New Value
Added	CPE Configuration		Record truncated, showing 500 of 654 characters. View Entire Change Record OR *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 2.6.12 up to (excluding) 5.10.227 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.11 up to (excluding) 5.15.168 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.16 up to (excluding) 6.1.113 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.2 up to (excluding) 6.6.57 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions fro
Added	CVSS V3.1		NIST AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Added	CWE		NIST CWE-908
Changed	Reference Type	https://git.kernel.org/stable/c/30d91a478d58cbae3dbaa8224d17d0d839f0d71b No Types Assigned	https://git.kernel.org/stable/c/30d91a478d58cbae3dbaa8224d17d0d839f0d71b Patch
Changed	Reference Type	https://git.kernel.org/stable/c/40dddd4b8bd08a69471efd96107a4e1c73fabefc No Types Assigned	https://git.kernel.org/stable/c/40dddd4b8bd08a69471efd96107a4e1c73fabefc Patch
Changed	Reference Type	https://git.kernel.org/stable/c/8fe992ff3df493d1949922ca234419f3ede08dff No Types Assigned	https://git.kernel.org/stable/c/8fe992ff3df493d1949922ca234419f3ede08dff Patch
Changed	Reference Type	https://git.kernel.org/stable/c/c007a14797240607038bd3464501109f408940e2 No Types Assigned	https://git.kernel.org/stable/c/c007a14797240607038bd3464501109f408940e2 Patch
Changed	Reference Type	https://git.kernel.org/stable/c/ce249a4c68d0ce27a8c5d853338d502e2711a314 No Types Assigned	https://git.kernel.org/stable/c/ce249a4c68d0ce27a8c5d853338d502e2711a314 Patch
Changed	Reference Type	https://git.kernel.org/stable/c/fadf8fdb3110d3138e05c3765f645535434f8d76 No Types Assigned	https://git.kernel.org/stable/c/fadf8fdb3110d3138e05c3765f645535434f8d76 Patch

New CVE Received by NIST 10/21/2024 4:15:16 PM

Action	Type	Old Value	New Value
Added	Description		Record truncated, showing 500 of 2846 characters. View Entire Change Record In the Linux kernel, the following vulnerability has been resolved: ppp: fix ppp_async_encode() illegal access syzbot reported an issue in ppp_async_encode() [1] In this case, pppoe_sendmsg() is called with a zero size. Then ppp_async_encode() is called with an empty skb. BUG: KMSAN: uninit-value in ppp_async_encode drivers/net/ppp/ppp_async.c:545 [inline] BUG: KMSAN: uninit-value in ppp_async_push+0xb4f/0x2660 drivers/net/ppp/ppp_async.c:675 ppp_async_encode drivers/net/ppp/ppp_async.c:5
Added	Reference		kernel.org https://git.kernel.org/stable/c/30d91a478d58cbae3dbaa8224d17d0d839f0d71b [No types assigned]
Added	Reference		kernel.org https://git.kernel.org/stable/c/40dddd4b8bd08a69471efd96107a4e1c73fabefc [No types assigned]
Added	Reference		kernel.org https://git.kernel.org/stable/c/8fe992ff3df493d1949922ca234419f3ede08dff [No types assigned]
Added	Reference		kernel.org https://git.kernel.org/stable/c/c007a14797240607038bd3464501109f408940e2 [No types assigned]
Added	Reference		kernel.org https://git.kernel.org/stable/c/ce249a4c68d0ce27a8c5d853338d502e2711a314 [No types assigned]
Added	Reference		kernel.org https://git.kernel.org/stable/c/fadf8fdb3110d3138e05c3765f645535434f8d76 [No types assigned]