From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B34B03613D for ; Mon, 18 Mar 2024 10:15:09 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1710756909; cv=none; b=kryzwPR8DOC8o8Dq5XhPOc8hiZAblOWqVUlyqUIgrSiLhPzRgUTMbvmdpjo7kGeT2bEcgGIDyQGGapkaANSyfgFzl43wFRZNoLuY3k5QCMo7006NrjUNc8qRTbvTs2SurkdMK8//2R8linl9Nv8oqJoGIag4CD7qOAZkQ85nU5c= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1710756909; c=relaxed/simple; bh=gU6nqW41Uop8Ie712h6bQSjVaTTdenqnYr/T91p/TIU=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=dcOLSpK46HEUbDFldH38eulGw63cw4oBF1j+7MukBPHxxbkD0dTpxb7XBz2iFattVKQuPasOKk18I3ZMTtLNGTF9glEbrP73u/v4VxZIA787Wm4oy3eqs7+InJ9GpFhWCafOKI4pgijcAYjT+GtgC6vu9uZc7NpBjXBDRyDHS30= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=ew8HH6r2; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="ew8HH6r2" Received: by smtp.kernel.org (Postfix) with ESMTPSA id A6CDCC43394; Mon, 18 Mar 2024 10:15:08 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1710756909; bh=gU6nqW41Uop8Ie712h6bQSjVaTTdenqnYr/T91p/TIU=; h=From:To:Cc:Subject:Date:Reply-to:From; b=ew8HH6r25B5E3wXKUNVMGjJsMeMUjdkPQesPhjLyTKuwHrR/7jMGvpn6BgPgRjvx6 QGAk51QUJ93ZzgcRkQmMvVveZcGV/33ZO8a/SRBLgX7ZCiyJVk6+8mermZB0kmJz4y mRYjYzAzuSfpnn3kCeqko0hBXmZRvDj/QaWRaF06zIuD97zQb1tUJzYa7ILzFHxpuF 2WyFEBLbvO0v4Z15YBiNiQVT3E1QadINWjLhbGGtVz8pSYRE6+xz7yZs8bT/RDMUHQ ROX87pTKL7QNx0/gJtUB2zfBAK0f+LBFx5AJMucp26AawnMH+pI0Zrq29o0xSvif9/ gnnxzo5yGqBZw== From: Lee Jones To: linux-cve-announce@vger.kernel.org Cc: Lee Jones Subject: CVE-2024-26635: llc: Drop support for ETH_P_TR_802_2. Date: Mon, 18 Mar 2024 10:15:03 +0000 Message-ID: <20240318101458.2835626-13-lee@kernel.org> X-Mailer: git-send-email 2.44.0.291.gc1ea87d7ee-goog Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Reply-to: , X-Developer-Signature: v=1; a=openpgp-sha256; l=5100; i=lee@kernel.org; h=from:subject; bh=gU6nqW41Uop8Ie712h6bQSjVaTTdenqnYr/T91p/TIU=; b=owEBbQKS/ZANAwAKAVGvii+H/HdhAcsmYgBl+BQjYpATKzX6eAEUSOUG8ry0mYhQzYbi8Qbw6 DhoZfr72NCJAjMEAAEKAB0WIQR2tsk1o74gmpTwh0hRr4ovh/x3YQUCZfgUIwAKCRBRr4ovh/x3 YWy+D/98ROAOdoF5oDlMPdSd+quWvYQ/3tgtLNAZxvLmMrcV+PJT316jRpIsgTVWdjIZbqtxWWL OvDgzzBjEoIW2PS8iGImwFGnSsPirTfG2wfz/w6xAgzrDd4lp/WZYyfzZnTTE8SAYmlkrKJunx5 Fe7eYXnxt6cMe9rpoeGBN84KOxugzzh3CmThJG2YwsWRV5VZ7AllFmaL/oRvcED0sljSYoGDF4d pnGZQ5wlS6Rzyr9MLv+uXTazjnlLJ76l0LIkUog6vjB7vmCMyTlfLJB5XsTC6BMZ50zZJVAVdkb NAof5SD0X8yivZFH+KlAup36KP8xBh+cBzQePQYswthSSbgKhYZhADprJjxz83I797MoflAUt0N qam52zsaBlOmtBIJCgLGcBXJP2u0am4aJZNxIJ+Wb3X3FJ4zCpNXMirE1DYe7SpQxBKxrcn0zTW swpi2fIcToC3awp8GMYtDpXdSblglj1RGHZc82GrKZ5gBKB5FN9mggx1DNTbqhXGBF8pQ/4bpKa raNb8LvDEwHupax8tsIo6eCEyI9krXLhfFqY1ig2emq4YF+cjMdcq3CzE79qbGN3k2dzBZ7uOPr 7QyRMcc6rCo0AxSYCxs3thGcJ/HJuP4ZsR1fmF7cQk05HpW3HDZRgEHsRthLYclhOIC1SyroXQ2 kQjpSkyj5BrP2Og== X-Developer-Key: i=lee@kernel.org; a=openpgp; fpr=76B6C935A3BE209A94F0874851AF8A2F87FC7761 Content-Transfer-Encoding: 8bit Description =========== In the Linux kernel, the following vulnerability has been resolved: llc: Drop support for ETH_P_TR_802_2. syzbot reported an uninit-value bug below. [0] llc supports ETH_P_802_2 (0x0004) and used to support ETH_P_TR_802_2 (0x0011), and syzbot abused the latter to trigger the bug. write$tun(r0, &(0x7f0000000040)={@val={0x0, 0x11}, @val, @mpls={[], @llc={@snap={0xaa, 0x1, ')', "90e5dd"}}}}, 0x16) llc_conn_handler() initialises local variables {saddr,daddr}.mac based on skb in llc_pdu_decode_sa()/llc_pdu_decode_da() and passes them to __llc_lookup(). However, the initialisation is done only when skb->protocol is htons(ETH_P_802_2), otherwise, __llc_lookup_established() and __llc_lookup_listener() will read garbage. The missing initialisation existed prior to commit 211ed865108e ("net: delete all instances of special processing for token ring"). It removed the part to kick out the token ring stuff but forgot to close the door allowing ETH_P_TR_802_2 packets to sneak into llc_rcv(). Let's remove llc_tr_packet_type and complete the deprecation. [0]: BUG: KMSAN: uninit-value in __llc_lookup_established+0xe9d/0xf90 __llc_lookup_established+0xe9d/0xf90 __llc_lookup net/llc/llc_conn.c:611 [inline] llc_conn_handler+0x4bd/0x1360 net/llc/llc_conn.c:791 llc_rcv+0xfbb/0x14a0 net/llc/llc_input.c:206 __netif_receive_skb_one_core net/core/dev.c:5527 [inline] __netif_receive_skb+0x1a6/0x5a0 net/core/dev.c:5641 netif_receive_skb_internal net/core/dev.c:5727 [inline] netif_receive_skb+0x58/0x660 net/core/dev.c:5786 tun_rx_batched+0x3ee/0x980 drivers/net/tun.c:1555 tun_get_user+0x53af/0x66d0 drivers/net/tun.c:2002 tun_chr_write_iter+0x3af/0x5d0 drivers/net/tun.c:2048 call_write_iter include/linux/fs.h:2020 [inline] new_sync_write fs/read_write.c:491 [inline] vfs_write+0x8ef/0x1490 fs/read_write.c:584 ksys_write+0x20f/0x4c0 fs/read_write.c:637 __do_sys_write fs/read_write.c:649 [inline] __se_sys_write fs/read_write.c:646 [inline] __x64_sys_write+0x93/0xd0 fs/read_write.c:646 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x44/0x110 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x63/0x6b Local variable daddr created at: llc_conn_handler+0x53/0x1360 net/llc/llc_conn.c:783 llc_rcv+0xfbb/0x14a0 net/llc/llc_input.c:206 CPU: 1 PID: 5004 Comm: syz-executor994 Not tainted 6.6.0-syzkaller-14500-g1c41041124bd #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/09/2023 The Linux kernel CVE team has assigned CVE-2024-26635 to this issue. Affected and fixed versions =========================== Issue introduced in 3.5 with commit 211ed865108e and fixed in 4.19.307 with commit 165ad1e22779 Issue introduced in 3.5 with commit 211ed865108e and fixed in 5.4.269 with commit b8e8838f82f3 Issue introduced in 3.5 with commit 211ed865108e and fixed in 5.10.210 with commit 9ccdef19cf94 Issue introduced in 3.5 with commit 211ed865108e and fixed in 5.15.149 with commit c0fe2fe7a5a2 Issue introduced in 3.5 with commit 211ed865108e and fixed in 6.1.76 with commit 660c3053d992 Issue introduced in 3.5 with commit 211ed865108e and fixed in 6.6.15 with commit f1f34a515fb1 Issue introduced in 3.5 with commit 211ed865108e and fixed in 6.7.3 with commit df57fc2f2abf Issue introduced in 3.5 with commit 211ed865108e and fixed in 6.8 with commit e3f9bed9bee2 Please see https://www.kernel.org or a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2024-26635 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: include/net/llc_pdu.h net/llc/llc_core.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/165ad1e22779685c3ed3dd349c6c4c632309cc62 https://git.kernel.org/stable/c/b8e8838f82f332ae80c643dbb1ca4418d0628097 https://git.kernel.org/stable/c/9ccdef19cf9497c2803b005369668feb91cacdfd https://git.kernel.org/stable/c/c0fe2fe7a5a291dfcf6dc64301732c8d3dc6a828 https://git.kernel.org/stable/c/660c3053d992b68fee893a0e9ec9159228cffdc6 https://git.kernel.org/stable/c/f1f34a515fb1e25e85dee94f781e7869ae351fb8 https://git.kernel.org/stable/c/df57fc2f2abf548aa889a36ab0bdcc94a75399dc https://git.kernel.org/stable/c/e3f9bed9bee261e3347131764e42aeedf1ffea61