Описание
In the Linux kernel, the following vulnerability has been resolved:
ieee802154: fix kernel-infoleak in dgram_recvmsg()
KMSAN reported a kernel-infoleak in move_addr_to_user():
BUG: KMSAN: kernel-infoleak in instrument_copy_to_user
include/linux/instrumented.h:131 [inline]
BUG: KMSAN: kernel-infoleak in _inline_copy_to_user
include/linux/uaccess.h:205 [inline]
BUG: KMSAN: kernel-infoleak in _copy_to_user+0xcc/0x120
lib/usercopy.c:26
instrument_copy_to_user include/linux/instrumented.h:131 [inline]
_inline_copy_to_user include/linux/uaccess.h:205 [inline]
_copy_to_user+0xcc/0x120 lib/usercopy.c:26
copy_to_user include/linux/uaccess.h:236 [inline]
move_addr_to_user+0x2e7/0x440 net/socket.c:302
____sys_recvmsg+0x232/0x610 net/socket.c:2925
...
Uninit was stored to memory at:
ieee802154_addr_to_sa include/net/ieee802154_netdev.h:369 [inline]
dgram_recvmsg+0xa09/0xbe0 net/ieee802154/socket.c:739
The issue occurs because the pan_id field of struct ieee802154_addr
is left uninitialized when the address mode is IEEE802154_ADDR_NONE.
The execution flow is as follows:
__ieee802154_rx_handle_packet()declares a localstruct ieee802154_hdr hdron the stack.ieee802154_hdr_pull()callsieee802154_hdr_get_addr()to parse the source and destination addresses into this structure.- If the address mode is
IEEE802154_ADDR_NONE,ieee802154_hdr_get_addr()previously only set themodefield, leaving thepan_idfield containing uninitialized stack memory. - This uninitialized
pan_idis later copied into astruct sockaddr_ieee802154indgram_recvmsg()viaieee802154_addr_to_sa(). - Finally,
move_addr_to_user()copies the socket address structure to user space, leaking the uninitialized bytes. Fix this by usingmemsetto zero out the address structure inieee802154_hdr_get_addr()when the mode isIEEE802154_ADDR_NONE.
A flaw was found in the Linux kernel's IEEE 802.15.4 (Wireless Personal Area Networks) networking component. This vulnerability allows a local user to expose sensitive kernel memory. The issue arises because a specific field (pan_id) in a network address structure is not properly cleared, leading to uninitialized data being copied to user space. This could result in the disclosure of potentially sensitive information from the kernel's memory.
Отчет
A flaw was found in the Linux kernel's IEEE 802.15.4 (wireless personal area network) implementation, where a local user can disclose a small amount of uninitialized kernel stack memory. When a received IEEE 802.15.4 frame uses the IEEE802154_ADDR_NONE address mode, the pan_id field of the in-kernel address structure is left uninitialized. When such a datagram is received on an AF_IEEE802154 datagram socket, that uninitialized data is copied into the sockaddr_ieee802154 structure returned to user space by recvmsg(), leaking uninitialized kernel stack bytes to the receiving process. The consequence is limited to information disclosure of potentially sensitive kernel memory. Red Hat rates this flaw as Moderate security impact. Red Hat Enterprise Linux 6 and 7 (kernel and kernel-rt) are not affected because the vulnerable code is not present. The kernel components in Red Hat Enterprise Linux 8, 9, and 10 update streams (together with kernel-rt where provided), and the kernel and kernel-ivos-qualcomm components in Red Hat In-Vehicle OS 2, are affected; for these streams the fix has been deferred. Because exploiting this flaw requires local access to receive IEEE 802.15.4 datagrams and the exposure is limited to a small amount of uninitialized kernel stack memory, the practical risk is considered low, and the fix will be delivered in a future planned update rather than an immediate z-stream update. The residual risk of the deferral is that a local unprivileged user could disclose a small amount of potentially sensitive kernel stack memory.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 6 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 8 | kernel-rt | Fix deferred | ||
| Red Hat Enterprise Linux 9 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 9 | kernel-rt | Fix deferred |
Показывать по
Дополнительная информация
Статус:
EPSS
5.5 Medium
CVSS3
Связанные уязвимости
In the Linux kernel, the following vulnerability has been resolved: ieee802154: fix kernel-infoleak in dgram_recvmsg() KMSAN reported a kernel-infoleak in move_addr_to_user(): BUG: KMSAN: kernel-infoleak in instrument_copy_to_user include/linux/instrumented.h:131 [inline] BUG: KMSAN: kernel-infoleak in _inline_copy_to_user include/linux/uaccess.h:205 [inline] BUG: KMSAN: kernel-infoleak in _copy_to_user+0xcc/0x120 lib/usercopy.c:26 instrument_copy_to_user include/linux/instrumented.h:131 [inline] _inline_copy_to_user include/linux/uaccess.h:205 [inline] _copy_to_user+0xcc/0x120 lib/usercopy.c:26 copy_to_user include/linux/uaccess.h:236 [inline] move_addr_to_user+0x2e7/0x440 net/socket.c:302 ____sys_recvmsg+0x232/0x610 net/socket.c:2925 ... Uninit was stored to memory at: ieee802154_addr_to_sa include/net/ieee802154_netdev.h:369 [inline] dgram_recvmsg+0xa09/0xbe0 net/ieee802154/socket.c:739 The issue occurs because the `pan_id` field of `struct ieee802154_addr` is left uninitialized ...
In the Linux kernel, the following vulnerability has been resolved: ieee802154: fix kernel-infoleak in dgram_recvmsg() KMSAN reported a kernel-infoleak in move_addr_to_user(): BUG: KMSAN: kernel-infoleak in instrument_copy_to_user include/linux/instrumented.h:131 [inline] BUG: KMSAN: kernel-infoleak in _inline_copy_to_user include/linux/uaccess.h:205 [inline] BUG: KMSAN: kernel-infoleak in _copy_to_user+0xcc/0x120 lib/usercopy.c:26 instrument_copy_to_user include/linux/instrumented.h:131 [inline] _inline_copy_to_user include/linux/uaccess.h:205 [inline] _copy_to_user+0xcc/0x120 lib/usercopy.c:26 copy_to_user include/linux/uaccess.h:236 [inline] move_addr_to_user+0x2e7/0x440 net/socket.c:302 ____sys_recvmsg+0x232/0x610 net/socket.c:2925 ... Uninit was stored to memory at: ieee802154_addr_to_sa include/net/ieee802154_netdev.h:369 [inline] dgram_recvmsg+0xa09/0xbe0 net/ieee802154/socket.c:739 The issue occurs because the `pan_id` field of `struct ieee802154_addr` is left uni
In the Linux kernel, the following vulnerability has been resolved: i ...
EPSS
5.5 Medium
CVSS3