Description

In the Linux kernel, the following vulnerability has been resolved: tcp_bpf: fix return value of tcp_bpf_sendmsg() When we cork messages in psock->cork, the last message triggers the flushing will result in sending a sk_msg larger than the current message size. In this case, in tcp_bpf_send_verdict(), 'copied' becomes negative at least in the following case: 468 case __SK_DROP: 469 default: 470 sk_msg_free_partial(sk, msg, tosend); 471 sk_msg_apply_bytes(psock, tosend); 472 *copied -= (tosend + delta); // <==== HERE 473 return -EACCES; Therefore, it could lead to the following BUG with a proper value of 'copied' (thanks to syzbot). We should not use negative 'copied' as a return value here. ------------[ cut here ]------------ kernel BUG at net/socket.c:733! Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP Modules linked in: CPU: 0 UID: 0 PID: 3265 Comm: syz-executor510 Not tainted 6.11.0-rc3-syzkaller-00060-gd07b43284ab3 #0 Hardware name: linux,dummy-virt (DT) pstate: 61400009 (nZCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--) pc : sock_sendmsg_nosec net/socket.c:733 [inline] pc : sock_sendmsg_nosec net/socket.c:728 [inline] pc : __sock_sendmsg+0x5c/0x60 net/socket.c:745 lr : sock_sendmsg_nosec net/socket.c:730 [inline] lr : __sock_sendmsg+0x54/0x60 net/socket.c:745 sp : ffff800088ea3b30 x29: ffff800088ea3b30 x28: fbf00000062bc900 x27: 0000000000000000 x26: ffff800088ea3bc0 x25: ffff800088ea3bc0 x24: 0000000000000000 x23: f9f00000048dc000 x22: 0000000000000000 x21: ffff800088ea3d90 x20: f9f00000048dc000 x19: ffff800088ea3d90 x18: 0000000000000001 x17: 0000000000000000 x16: 0000000000000000 x15: 000000002002ffaf x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000 x11: 0000000000000000 x10: ffff8000815849c0 x9 : ffff8000815b49c0 x8 : 0000000000000000 x7 : 000000000000003f x6 : 0000000000000000 x5 : 00000000000007e0 x4 : fff07ffffd239000 x3 : fbf00000062bc900 x2 : 0000000000000000 x1 : 0000000000000000 x0 : 00000000fffffdef Call trace: sock_sendmsg_nosec net/socket.c:733 [inline] __sock_sendmsg+0x5c/0x60 net/socket.c:745 ____sys_sendmsg+0x274/0x2ac net/socket.c:2597 ___sys_sendmsg+0xac/0x100 net/socket.c:2651 __sys_sendmsg+0x84/0xe0 net/socket.c:2680 __do_sys_sendmsg net/socket.c:2689 [inline] __se_sys_sendmsg net/socket.c:2687 [inline] __arm64_sys_sendmsg+0x24/0x30 net/socket.c:2687 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x48/0x110 arch/arm64/kernel/syscall.c:49 el0_svc_common.constprop.0+0x40/0xe0 arch/arm64/kernel/syscall.c:132 do_el0_svc+0x1c/0x28 arch/arm64/kernel/syscall.c:151 el0_svc+0x34/0xec arch/arm64/kernel/entry-common.c:712 el0t_64_sync_handler+0x100/0x12c arch/arm64/kernel/entry-common.c:730 el0t_64_sync+0x19c/0x1a0 arch/arm64/kernel/entry.S:598 Code: f9404463 d63f0060 3108441f 54fffe81 (d4210000) ---[ end trace 0000000000000000 ]---

Metrics

 

CVSS Version 4.0 CVSS Version 3.x CVSS Version 2.0

NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed.

CVSS 4.0 Severity and Vector Strings:

NIST: NVD

N/A

NVD assessment not yet provided.

CVSS 3.x Severity and Vector Strings:

NIST: NVD

Base Score:  5.5 MEDIUM

Vector:  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CVSS 2.0 Severity and Vector Strings:

NIST: NVD

Base Score: N/A

NVD assessment not yet provided.

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

Hyperlink	Resource
https://git.kernel.org/stable/c/126d72b726c4cf1119f3a7fe413a78d341c3fea9	Patch
https://git.kernel.org/stable/c/3efe53eb221a38e207c1e3f81c51e4ca057d50c2	Patch
https://git.kernel.org/stable/c/6f9fdf5806cced888c43512bccbdf7fefd50f510	Patch
https://git.kernel.org/stable/c/78bb38d9c5a311c5f8bdef7c9557d7d81ca30e4a	Patch
https://git.kernel.org/stable/c/810a4e7d92dea4074cb04c25758320909d752193	Patch
https://git.kernel.org/stable/c/c8219a27fa43a2cbf99f5176f6dddfe73e7a24ae	Patch
https://git.kernel.org/stable/c/fe1910f9337bd46a9343967b547ccab26b4b2c6e	Patch

Weakness Enumeration

CWE-ID	CWE Name	Source
NVD-CWE-noinfo	Insufficient Information	NIST

Known Affected Software Configurations Switch to CPE 2.2

CPEs loading, please wait.

Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.

Change History

2 change records found show changes

Initial Analysis by NIST 11/20/2024 10:47:35 AM

Action	Type	Old Value	New Value
Added	CPE Configuration		Record truncated, showing 500 of 984 characters. View Entire Change Record OR *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 4.17 up to (excluding) 5.4.284 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.5 up to (excluding) 5.10.226 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.11 up to (excluding) 5.15.167 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.16 up to (excluding) 6.1.110 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from
Added	CVSS V3.1		NIST AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Added	CWE		NIST NVD-CWE-noinfo
Changed	Reference Type	https://git.kernel.org/stable/c/126d72b726c4cf1119f3a7fe413a78d341c3fea9 No Types Assigned	https://git.kernel.org/stable/c/126d72b726c4cf1119f3a7fe413a78d341c3fea9 Patch
Changed	Reference Type	https://git.kernel.org/stable/c/3efe53eb221a38e207c1e3f81c51e4ca057d50c2 No Types Assigned	https://git.kernel.org/stable/c/3efe53eb221a38e207c1e3f81c51e4ca057d50c2 Patch
Changed	Reference Type	https://git.kernel.org/stable/c/6f9fdf5806cced888c43512bccbdf7fefd50f510 No Types Assigned	https://git.kernel.org/stable/c/6f9fdf5806cced888c43512bccbdf7fefd50f510 Patch
Changed	Reference Type	https://git.kernel.org/stable/c/78bb38d9c5a311c5f8bdef7c9557d7d81ca30e4a No Types Assigned	https://git.kernel.org/stable/c/78bb38d9c5a311c5f8bdef7c9557d7d81ca30e4a Patch
Changed	Reference Type	https://git.kernel.org/stable/c/810a4e7d92dea4074cb04c25758320909d752193 No Types Assigned	https://git.kernel.org/stable/c/810a4e7d92dea4074cb04c25758320909d752193 Patch
Changed	Reference Type	https://git.kernel.org/stable/c/c8219a27fa43a2cbf99f5176f6dddfe73e7a24ae No Types Assigned	https://git.kernel.org/stable/c/c8219a27fa43a2cbf99f5176f6dddfe73e7a24ae Patch
Changed	Reference Type	https://git.kernel.org/stable/c/fe1910f9337bd46a9343967b547ccab26b4b2c6e No Types Assigned	https://git.kernel.org/stable/c/fe1910f9337bd46a9343967b547ccab26b4b2c6e Patch

New CVE Received by NIST 9/18/2024 4:15:05 AM

Action	Type	Old Value	New Value
Added	Description		Record truncated, showing 500 of 3033 characters. View Entire Change Record In the Linux kernel, the following vulnerability has been resolved: tcp_bpf: fix return value of tcp_bpf_sendmsg() When we cork messages in psock->cork, the last message triggers the flushing will result in sending a sk_msg larger than the current message size. In this case, in tcp_bpf_send_verdict(), 'copied' becomes negative at least in the following case: 468 case __SK_DROP: 469 default: 470 sk_msg_free_partial(sk, msg, tosend); 471 sk_msg_ap
Added	Reference		kernel.org https://git.kernel.org/stable/c/126d72b726c4cf1119f3a7fe413a78d341c3fea9 [No types assigned]
Added	Reference		kernel.org https://git.kernel.org/stable/c/3efe53eb221a38e207c1e3f81c51e4ca057d50c2 [No types assigned]
Added	Reference		kernel.org https://git.kernel.org/stable/c/6f9fdf5806cced888c43512bccbdf7fefd50f510 [No types assigned]
Added	Reference		kernel.org https://git.kernel.org/stable/c/78bb38d9c5a311c5f8bdef7c9557d7d81ca30e4a [No types assigned]
Added	Reference		kernel.org https://git.kernel.org/stable/c/810a4e7d92dea4074cb04c25758320909d752193 [No types assigned]
Added	Reference		kernel.org https://git.kernel.org/stable/c/c8219a27fa43a2cbf99f5176f6dddfe73e7a24ae [No types assigned]
Added	Reference		kernel.org https://git.kernel.org/stable/c/fe1910f9337bd46a9343967b547ccab26b4b2c6e [No types assigned]