From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 19BB819047A for ; Sat, 11 Jan 2025 12:36:30 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1736598991; cv=none; b=Ql4yVyaGkJVfoB3Iz7O0nrIEQYFbU3u9ZSRoelorG06dm2/Ym5SlGdeeGg+qDwYKVAplgZo/KmzXleDUu9yhKey+WZLheoplBzo3wjdEmBHD+d9ccWWpgPBfQ3OyJm5l/H7coaMwIU6YH8Y8G/fFZz7MHJfUATp56C3AsjQCBOc= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1736598991; c=relaxed/simple; bh=m7XmQ8BNvtc9f8gYlb68Rq+w7Jgy3LzU36IvJSaCbs4=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=ZqpXZ7T6+1uY0ql761Xg2PX3Cx+gcCuPzeACTHYOWFNNvcd/56C+65xuYLjXe8DRpQD+O3p3fXK2KmZGca52wQ7nEF3jupQkijlHZJVUW80/gTFOxprq141VD1ePdO/YIje5EZcW+DEw4YPQqGOYHUl7IBpIye9wG3uUC5jw/D4= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=Gchu8gj/; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="Gchu8gj/" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 101D6C4CED2; Sat, 11 Jan 2025 12:36:29 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1736598990; bh=m7XmQ8BNvtc9f8gYlb68Rq+w7Jgy3LzU36IvJSaCbs4=; h=From:To:Cc:Subject:Date:Reply-to:From; b=Gchu8gj/OAPMJaWI9/14IEobvDaDv2LUU/kF4CeS8qxWDBlDJTUPv19PS0eUVce+T TIDkI2K0MiNNZ5t5LtvpUNqcAWOOZpj1d7A4kxphE48iStHbuMaYHn4S2zSV6TCZ0A x6r0tcHggRfuKkQAJho4Se3ZWt1krJSaE7vF870k= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2024-57791: net/smc: check return value of sock_recvmsg when draining clc data Date: Sat, 11 Jan 2025 13:36:01 +0100 Message-ID: <2025011147-CVE-2024-57791-7bc8@gregkh> X-Mailer: git-send-email 2.48.0 Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Reply-to: , X-Developer-Signature: v=1; a=openpgp-sha256; l=3146; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=m7XmQ8BNvtc9f8gYlb68Rq+w7Jgy3LzU36IvJSaCbs4=; b=owGbwMvMwCRo6H6F97bub03G02pJDOlNqYu1/xQxqzVwHJZv/HsvInf2vaU2ofdlInJb6zom3 mGS+/ijI5aFQZCJQVZMkeXLNp6j+ysOKXoZ2p6GmcPKBDKEgYtTACZyt5NhfsHtP3fn7xXZEFqf Lfnk6b/WL26WigzzE11jGK8/XFldIxS55OuKV+rBJuxTAA== X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit Description =========== In the Linux kernel, the following vulnerability has been resolved: net/smc: check return value of sock_recvmsg when draining clc data When receiving clc msg, the field length in smc_clc_msg_hdr indicates the length of msg should be received from network and the value should not be fully trusted as it is from the network. Once the value of length exceeds the value of buflen in function smc_clc_wait_msg it may run into deadloop when trying to drain the remaining data exceeding buflen. This patch checks the return value of sock_recvmsg when draining data in case of deadloop in draining. The Linux kernel CVE team has assigned CVE-2024-57791 to this issue. Affected and fixed versions =========================== Issue introduced in 5.8 with commit fb4f79264c0fc6fd5a68ffe3e31bfff97311e1f1 and fixed in 5.10.233 with commit 82c7ad9ca09975aae737abffd66d1ad98874c13d Issue introduced in 5.8 with commit fb4f79264c0fc6fd5a68ffe3e31bfff97311e1f1 and fixed in 5.15.176 with commit 6b80924af6216277892d5f091f5bfc7d1265fa28 Issue introduced in 5.8 with commit fb4f79264c0fc6fd5a68ffe3e31bfff97311e1f1 and fixed in 6.1.122 with commit d7d1f986ebb284b1db8dafca7d1bdb6dd2445cf6 Issue introduced in 5.8 with commit fb4f79264c0fc6fd5a68ffe3e31bfff97311e1f1 and fixed in 6.6.68 with commit 7a6927814b4256d603e202ae7c5e38db3b338896 Issue introduced in 5.8 with commit fb4f79264c0fc6fd5a68ffe3e31bfff97311e1f1 and fixed in 6.12.7 with commit df3dfe1a93c6298d8c09a18e4fba19ef5b17763b Issue introduced in 5.8 with commit fb4f79264c0fc6fd5a68ffe3e31bfff97311e1f1 and fixed in 6.13-rc4 with commit c5b8ee5022a19464783058dc6042e8eefa34e8cd Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2024-57791 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: net/smc/smc_clc.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/82c7ad9ca09975aae737abffd66d1ad98874c13d https://git.kernel.org/stable/c/6b80924af6216277892d5f091f5bfc7d1265fa28 https://git.kernel.org/stable/c/d7d1f986ebb284b1db8dafca7d1bdb6dd2445cf6 https://git.kernel.org/stable/c/7a6927814b4256d603e202ae7c5e38db3b338896 https://git.kernel.org/stable/c/df3dfe1a93c6298d8c09a18e4fba19ef5b17763b https://git.kernel.org/stable/c/c5b8ee5022a19464783058dc6042e8eefa34e8cd