CVE-2024-35888

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: erspan: make sure erspan_base_hdr is present in skb->head syzbot reported a problem in ip6erspan_rcv() [1] Issue is that ip6erspan_rcv() (and erspan_rcv()) no longer make sure erspan_base_hdr is present in skb linear part (skb->head) before getting @ver field from it. Add the missing pskb_may_pull() calls. v2: Reload iph pointer in erspan_rcv() after pskb_may_pull() because skb->head might have changed. [1] BUG: KMSAN: uninit-value in pskb_may_pull_reason include/linux/skbuff.h:2742 [inline] BUG: KMSAN: uninit-value in pskb...

Affected product and versions

Product

Linux Linux, SIMATIC S7-1500 TM MFP - GNU/Linux subsystem, SIMATIC S7-1500 CPU 1518-4 PN/DP MFP

Affected versions

>= 0a198e0bb8bef51ced179702ad1af6f9e3715b64 < 06a939f72a24a7d8251f84cf4c042df86c6666ac, >= cb73ee40b1b381eaf3749e6dbeed567bb38e5258 < e54a0c79cdc2548729dd7e2e468b08c5af4d0df5, >= cb73ee40b1b381eaf3749e6dbeed567bb38e5258 < b14b9f9503ec823ca75be766dcaeff4f0bfeca85, >= cb73ee40b1b381eaf3749e6dbeed567bb38e5258 < ee0088101beee10fa809716d6245d915b09c37c7, >= cb73ee40b1b381eaf3749e6dbeed567bb38e5258 < 1db7fcb2b290c47c202b79528824f119fa28937d, >= cb73ee40b1b381eaf3749e6dbeed567bb38e5258 < 4e3fdeecec5707678b0d1f18c259dadb97262e9d, >= cb73ee40b1b381eaf3749e6dbeed567bb38e5258 < 0ac328a5a4138a6c03dfc3f46017bd5c19167446, >= cb73ee40b1b381eaf3749e6dbeed567bb38e5258 < 17af420545a750f763025149fa7b833a4fc8b8f0, >= 5195acd38ae48b7b5c186f522cd4351441297859, >= 4.19.20 < 4.19.312, >= 4.20.7 < 4.21, >= 5.0, >= V3.1.0 < V3.1.5, >= 4.20.7 < 5.4.274, >= 5.5 < 5.10.215, >= 5.11 < 5.15.154, >= 5.16 < 6.1.85, >= 6.2 < 6.6.26, >= 6.7 < 6.8.5, 6.9

Fixed versions

4.19.312, 5.4.274, 5.10.215, 5.15.154, 6.1.85, 6.6.26, 6.8.5

Technical data

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

CWE

CWE-908