cve-2024-41048
Vulnerability from cvelistv5
Published
2024-07-29 14:32
Modified
2024-11-05 09:35
Severity ?
Summary
skmsg: Skip zero length skb in sk_msg_recvmsg
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/195b7bcdfc5adc5b2468f279dd9eb7eebd2e7632
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/b180739b45a38b4caa88fe16bb5273072e6613dc
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/f0c18025693707ec344a70b6887f7450bf4c826b
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/f8bd689f37f4198a4c61c4684f591ba639595b97
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/fb61d7b9fb6ef0032de469499a54dab4c7260d0d
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/195b7bcdfc5adc5b2468f279dd9eb7eebd2e7632
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/b180739b45a38b4caa88fe16bb5273072e6613dc
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/f0c18025693707ec344a70b6887f7450bf4c826b
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/f8bd689f37f4198a4c61c4684f591ba639595b97
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/fb61d7b9fb6ef0032de469499a54dab4c7260d0d
Impacted products
Vendor Product Version
Linux Linux Version: 4.20
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T04:46:51.622Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/195b7bcdfc5adc5b2468f279dd9eb7eebd2e7632"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/fb61d7b9fb6ef0032de469499a54dab4c7260d0d"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/b180739b45a38b4caa88fe16bb5273072e6613dc"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/f8bd689f37f4198a4c61c4684f591ba639595b97"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/f0c18025693707ec344a70b6887f7450bf4c826b"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-41048",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T16:22:50.876207Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:34:02.036Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/core/skmsg.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "195b7bcdfc5a",
              "status": "affected",
              "version": "604326b41a6f",
              "versionType": "git"
            },
            {
              "lessThan": "fb61d7b9fb6e",
              "status": "affected",
              "version": "604326b41a6f",
              "versionType": "git"
            },
            {
              "lessThan": "b180739b45a3",
              "status": "affected",
              "version": "604326b41a6f",
              "versionType": "git"
            },
            {
              "lessThan": "f8bd689f37f4",
              "status": "affected",
              "version": "604326b41a6f",
              "versionType": "git"
            },
            {
              "lessThan": "f0c180256937",
              "status": "affected",
              "version": "604326b41a6f",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/core/skmsg.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.20"
            },
            {
              "lessThan": "4.20",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.163",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.100",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.41",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.9.*",
              "status": "unaffected",
              "version": "6.9.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.10",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nskmsg: Skip zero length skb in sk_msg_recvmsg\n\nWhen running BPF selftests (./test_progs -t sockmap_basic) on a Loongarch\nplatform, the following kernel panic occurs:\n\n  [...]\n  Oops[#1]:\n  CPU: 22 PID: 2824 Comm: test_progs Tainted: G           OE  6.10.0-rc2+ #18\n  Hardware name: LOONGSON Dabieshan/Loongson-TC542F0, BIOS Loongson-UDK2018\n     ... ...\n     ra: 90000000048bf6c0 sk_msg_recvmsg+0x120/0x560\n    ERA: 9000000004162774 copy_page_to_iter+0x74/0x1c0\n   CRMD: 000000b0 (PLV0 -IE -DA +PG DACF=CC DACM=CC -WE)\n   PRMD: 0000000c (PPLV0 +PIE +PWE)\n   EUEN: 00000007 (+FPE +SXE +ASXE -BTE)\n   ECFG: 00071c1d (LIE=0,2-4,10-12 VS=7)\n  ESTAT: 00010000 [PIL] (IS= ECode=1 EsubCode=0)\n   BADV: 0000000000000040\n   PRID: 0014c011 (Loongson-64bit, Loongson-3C5000)\n  Modules linked in: bpf_testmod(OE) xt_CHECKSUM xt_MASQUERADE xt_conntrack\n  Process test_progs (pid: 2824, threadinfo=0000000000863a31, task=...)\n  Stack : ...\n  Call Trace:\n  [\u003c9000000004162774\u003e] copy_page_to_iter+0x74/0x1c0\n  [\u003c90000000048bf6c0\u003e] sk_msg_recvmsg+0x120/0x560\n  [\u003c90000000049f2b90\u003e] tcp_bpf_recvmsg_parser+0x170/0x4e0\n  [\u003c90000000049aae34\u003e] inet_recvmsg+0x54/0x100\n  [\u003c900000000481ad5c\u003e] sock_recvmsg+0x7c/0xe0\n  [\u003c900000000481e1a8\u003e] __sys_recvfrom+0x108/0x1c0\n  [\u003c900000000481e27c\u003e] sys_recvfrom+0x1c/0x40\n  [\u003c9000000004c076ec\u003e] do_syscall+0x8c/0xc0\n  [\u003c9000000003731da4\u003e] handle_syscall+0xc4/0x160\n  Code: ...\n  ---[ end trace 0000000000000000 ]---\n  Kernel panic - not syncing: Fatal exception\n  Kernel relocated by 0x3510000\n   .text @ 0x9000000003710000\n   .data @ 0x9000000004d70000\n   .bss  @ 0x9000000006469400\n  ---[ end Kernel panic - not syncing: Fatal exception ]---\n  [...]\n\nThis crash happens every time when running sockmap_skb_verdict_shutdown\nsubtest in sockmap_basic.\n\nThis crash is because a NULL pointer is passed to page_address() in the\nsk_msg_recvmsg(). Due to the different implementations depending on the\narchitecture, page_address(NULL) will trigger a panic on Loongarch\nplatform but not on x86 platform. So this bug was hidden on x86 platform\nfor a while, but now it is exposed on Loongarch platform. The root cause\nis that a zero length skb (skb-\u003elen == 0) was put on the queue.\n\nThis zero length skb is a TCP FIN packet, which was sent by shutdown(),\ninvoked in test_sockmap_skb_verdict_shutdown():\n\n\tshutdown(p1, SHUT_WR);\n\nIn this case, in sk_psock_skb_ingress_enqueue(), num_sge is zero, and no\npage is put to this sge (see sg_set_page in sg_set_page), but this empty\nsge is queued into ingress_msg list.\n\nAnd in sk_msg_recvmsg(), this empty sge is used, and a NULL page is got by\nsg_page(sge). Pass this NULL page to copy_page_to_iter(), which passes it\nto kmap_local_page() and to page_address(), then kernel panics.\n\nTo solve this, we should skip this zero length skb. So in sk_msg_recvmsg(),\nif copy is zero, that means it\u0027s a zero length skb, skip invoking\ncopy_page_to_iter(). We are using the EFAULT return triggered by\ncopy_page_to_iter to check for is_fin in tcp_bpf.c."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-11-05T09:35:39.160Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/195b7bcdfc5adc5b2468f279dd9eb7eebd2e7632"
        },
        {
          "url": "https://git.kernel.org/stable/c/fb61d7b9fb6ef0032de469499a54dab4c7260d0d"
        },
        {
          "url": "https://git.kernel.org/stable/c/b180739b45a38b4caa88fe16bb5273072e6613dc"
        },
        {
          "url": "https://git.kernel.org/stable/c/f8bd689f37f4198a4c61c4684f591ba639595b97"
        },
        {
          "url": "https://git.kernel.org/stable/c/f0c18025693707ec344a70b6887f7450bf4c826b"
        }
      ],
      "title": "skmsg: Skip zero length skb in sk_msg_recvmsg",
      "x_generator": {
        "engine": "bippy-9e1c9544281a"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-41048",
    "datePublished": "2024-07-29T14:32:05.224Z",
    "dateReserved": "2024-07-12T12:17:45.625Z",
    "dateUpdated": "2024-11-05T09:35:39.160Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-41048\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-07-29T15:15:13.103\",\"lastModified\":\"2024-11-21T09:32:08.240\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nskmsg: Skip zero length skb in sk_msg_recvmsg\\n\\nWhen running BPF selftests (./test_progs -t sockmap_basic) on a Loongarch\\nplatform, the following kernel panic occurs:\\n\\n  [...]\\n  Oops[#1]:\\n  CPU: 22 PID: 2824 Comm: test_progs Tainted: G           OE  6.10.0-rc2+ #18\\n  Hardware name: LOONGSON Dabieshan/Loongson-TC542F0, BIOS Loongson-UDK2018\\n     ... ...\\n     ra: 90000000048bf6c0 sk_msg_recvmsg+0x120/0x560\\n    ERA: 9000000004162774 copy_page_to_iter+0x74/0x1c0\\n   CRMD: 000000b0 (PLV0 -IE -DA +PG DACF=CC DACM=CC -WE)\\n   PRMD: 0000000c (PPLV0 +PIE +PWE)\\n   EUEN: 00000007 (+FPE +SXE +ASXE -BTE)\\n   ECFG: 00071c1d (LIE=0,2-4,10-12 VS=7)\\n  ESTAT: 00010000 [PIL] (IS= ECode=1 EsubCode=0)\\n   BADV: 0000000000000040\\n   PRID: 0014c011 (Loongson-64bit, Loongson-3C5000)\\n  Modules linked in: bpf_testmod(OE) xt_CHECKSUM xt_MASQUERADE xt_conntrack\\n  Process test_progs (pid: 2824, threadinfo=0000000000863a31, task=...)\\n  Stack : ...\\n  Call Trace:\\n  [\u003c9000000004162774\u003e] copy_page_to_iter+0x74/0x1c0\\n  [\u003c90000000048bf6c0\u003e] sk_msg_recvmsg+0x120/0x560\\n  [\u003c90000000049f2b90\u003e] tcp_bpf_recvmsg_parser+0x170/0x4e0\\n  [\u003c90000000049aae34\u003e] inet_recvmsg+0x54/0x100\\n  [\u003c900000000481ad5c\u003e] sock_recvmsg+0x7c/0xe0\\n  [\u003c900000000481e1a8\u003e] __sys_recvfrom+0x108/0x1c0\\n  [\u003c900000000481e27c\u003e] sys_recvfrom+0x1c/0x40\\n  [\u003c9000000004c076ec\u003e] do_syscall+0x8c/0xc0\\n  [\u003c9000000003731da4\u003e] handle_syscall+0xc4/0x160\\n  Code: ...\\n  ---[ end trace 0000000000000000 ]---\\n  Kernel panic - not syncing: Fatal exception\\n  Kernel relocated by 0x3510000\\n   .text @ 0x9000000003710000\\n   .data @ 0x9000000004d70000\\n   .bss  @ 0x9000000006469400\\n  ---[ end Kernel panic - not syncing: Fatal exception ]---\\n  [...]\\n\\nThis crash happens every time when running sockmap_skb_verdict_shutdown\\nsubtest in sockmap_basic.\\n\\nThis crash is because a NULL pointer is passed to page_address() in the\\nsk_msg_recvmsg(). Due to the different implementations depending on the\\narchitecture, page_address(NULL) will trigger a panic on Loongarch\\nplatform but not on x86 platform. So this bug was hidden on x86 platform\\nfor a while, but now it is exposed on Loongarch platform. The root cause\\nis that a zero length skb (skb-\u003elen == 0) was put on the queue.\\n\\nThis zero length skb is a TCP FIN packet, which was sent by shutdown(),\\ninvoked in test_sockmap_skb_verdict_shutdown():\\n\\n\\tshutdown(p1, SHUT_WR);\\n\\nIn this case, in sk_psock_skb_ingress_enqueue(), num_sge is zero, and no\\npage is put to this sge (see sg_set_page in sg_set_page), but this empty\\nsge is queued into ingress_msg list.\\n\\nAnd in sk_msg_recvmsg(), this empty sge is used, and a NULL page is got by\\nsg_page(sge). Pass this NULL page to copy_page_to_iter(), which passes it\\nto kmap_local_page() and to page_address(), then kernel panics.\\n\\nTo solve this, we should skip this zero length skb. So in sk_msg_recvmsg(),\\nif copy is zero, that means it\u0027s a zero length skb, skip invoking\\ncopy_page_to_iter(). We are using the EFAULT return triggered by\\ncopy_page_to_iter to check for is_fin in tcp_bpf.c.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: skmsg: omitir skb de longitud cero en sk_msg_recvmsg Al ejecutar autopruebas de BPF (./test_progs -t sockmap_basic) en una plataforma Loongarch, se produce el siguiente p\u00e1nico del kernel: [...] Ups[ #1]: CPU: 22 PID: 2824 Comm: test_progs Contaminado: G OE 6.10.0-rc2+ #18 Nombre del hardware: LOONGSON Dabieshan/Loongson-TC542F0, BIOS Loongson-UDK2018 ... ... ra: 90000000048bf6c0 sk_msg_recvmsg+0x120 /0x560 ERA: 9000000004162774 copy_page_to_iter+0x74/0x1c0 CRMD: 000000b0 (PLV0 -IE -DA +PG DACF=CC DACM=CC -WE) PRMD: 0000000c (PPLV0 +PIE +PWE) EUEN: 00000007 (+FPE +SXE +ASXE -BTE) ECFG: 00071c1d (LIE=0,2-4,10-12 VS=7) ESTAT: 00010000 [PIL] (IS= ECode=1 EssubCode=0) BADV: 00000000000000040 PRID: 0014c011 (Loongson-64bit, Loongson -3C5000) M\u00f3dulos vinculados en: bpf_testmod(OE) xt_CHECKSUM xt_MASQUERADE xt_conntrack Procesar test_progs (pid: 2824, threadinfo=0000000000863a31, task=...) Pila: ... Seguimiento de llamadas: [\u0026lt;9000000004162774\u0026gt;] 1c0 [ \u0026lt;90000000048bf6c0\u0026gt;] sk_msg_recvmsg+0x120/0x560 [\u0026lt;90000000049f2b90\u0026gt;] tcp_bpf_recvmsg_parser+0x170/0x4e0 [\u0026lt;90000000049aae34\u0026gt;] 0x54/0x100 [\u0026lt;900000000481ad5c\u0026gt;] sock_recvmsg+0x7c/0xe0 [\u0026lt;900000000481e1a8\u0026gt;] __sys_recvfrom+0x108/0x1c0 [ \u0026lt;900000000481e27c\u0026gt;] sys_recvfrom+0x1c/0x40 [\u0026lt;9000000004c076ec\u0026gt;] do_syscall+0x8c/0xc0 [\u0026lt;9000000003731da4\u0026gt;] handle_syscall+0xc4/0x160 C\u00f3digo: ... ---[ end trace 0000000 000000000 ]--- P\u00e1nico del kernel: no se sincroniza : Excepci\u00f3n fatal Kernel reubicado por 0x3510000 .text @ 0x9000000003710000 .data @ 0x9000000004d70000 .bss @ 0x9000000006469400 ---[ fin del p\u00e1nico del kernel - no se sincroniza: excepci\u00f3n fatal ]--- [...] Este bloqueo ocurre cada vez que se ejecuta sockmap_ subprueba skb_verdict_shutdown en sockmap_basic. Este bloqueo se debe a que se pasa un puntero NULL a page_address() en sk_msg_recvmsg(). Debido a las diferentes implementaciones seg\u00fan la arquitectura, page_address(NULL) provocar\u00e1 un p\u00e1nico en la plataforma Loongarch pero no en la plataforma x86. Entonces, este error estuvo oculto en la plataforma x86 por un tiempo, pero ahora est\u00e1 expuesto en la plataforma Loongarch. La causa principal es que se coloc\u00f3 en la cola un skb de longitud cero (skb-\u0026gt;len == 0). Este skb de longitud cero es un paquete TCP FIN, que fue enviado por apagado(), invocado en test_sockmap_skb_verdict_shutdown(): apagado(p1, SHUT_WR); En este caso, en sk_psock_skb_ingress_enqueue(), num_sge es cero y no se coloca ninguna p\u00e1gina en este sge (consulte sg_set_page en sg_set_page), pero este sge vac\u00edo se pone en cola en la lista ingress_msg. Y en sk_msg_recvmsg(), se usa este sge vac\u00edo, y sg_page(sge) obtiene una p\u00e1gina NULL. Pase esta p\u00e1gina NULL a copy_page_to_iter(), que la pasa a kmap_local_page() y a page_address(), luego el kernel entra en p\u00e1nico. Para resolver esto, debemos omitir este skb de longitud cero. Entonces, en sk_msg_recvmsg(), si la copia es cero, eso significa que es un skb de longitud cero, omita la invocaci\u00f3n de copy_page_to_iter(). Estamos utilizando el retorno EFAULT activado por copy_page_to_iter para verificar is_fin en tcp_bpf.c.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/195b7bcdfc5adc5b2468f279dd9eb7eebd2e7632\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/b180739b45a38b4caa88fe16bb5273072e6613dc\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f0c18025693707ec344a70b6887f7450bf4c826b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f8bd689f37f4198a4c61c4684f591ba639595b97\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/fb61d7b9fb6ef0032de469499a54dab4c7260d0d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/195b7bcdfc5adc5b2468f279dd9eb7eebd2e7632\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://git.kernel.org/stable/c/b180739b45a38b4caa88fe16bb5273072e6613dc\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://git.kernel.org/stable/c/f0c18025693707ec344a70b6887f7450bf4c826b\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://git.kernel.org/stable/c/f8bd689f37f4198a4c61c4684f591ba639595b97\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://git.kernel.org/stable/c/fb61d7b9fb6ef0032de469499a54dab4c7260d0d\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.