CVE-2024-35976

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: xsk: validate user input for XDP_{UMEM|COMPLETION}_FILL_RING syzbot reported an illegal copy in xsk_setsockopt() [1] Make sure to validate setsockopt() @optlen parameter. [1] BUG: KASAN: slab-out-of-bounds in copy_from_sockptr_offset include/linux/sockptr.h:49 [inline] BUG: KASAN: slab-out-of-bounds in copy_from_sockptr include/linux/sockptr.h:55 [inline] BUG: KASAN: slab-out-of-bounds in xsk_setsockopt+0x909/0xa40 net/xdp/xsk.c:1420 Read of size 4 at addr ffff888028c6cde3 by task syz-executor.0/7549 CPU: 0 PID: 7549 Comm:...

Affected product and versions

Product

Linux Linux, linux_kernel, RUGGEDCOM RST2428P

Affected versions

>= 423f38329d267969130fb6f2c685f73d72687558 < beb99266830520e15fbc6ca8cc5a5240d76851fd, >= 423f38329d267969130fb6f2c685f73d72687558 < 0b45c25d60e38f5c2cb6823f886773a34323306d, >= 423f38329d267969130fb6f2c685f73d72687558 < a82984b3c6a7e8c7937dba6e857ddf829d149417, >= 423f38329d267969130fb6f2c685f73d72687558 < f0a068de65d5b7358e9aff792716afa9333f3922, >= 423f38329d267969130fb6f2c685f73d72687558 < 2a523f14a3f53b46ff0e1fafd215b0bc5f6783aa, >= 423f38329d267969130fb6f2c685f73d72687558 < b143e19dc28c3211f050f7848d87d9b0a170e10c, >= 423f38329d267969130fb6f2c685f73d72687558 < 2eb979fbb2479bcd7e049f2f9978b6590dd8a0e6, >= 423f38329d267969130fb6f2c685f73d72687558 < 237f3cf13b20db183d3706d997eedc3c49eacd44, >= 4.18, < V3.1, >= 4.18 < 4.19.317, >= 4.20 < 5.4.278, >= 5.5 < 5.10.216, >= 5.11 < 5.15.156, >= 5.16 < 6.1.87, >= 6.2 < 6.6.28, >= 6.7 < 6.8.7, 6.9

Fixed versions

4.19.317, 5.4.278, 5.10.216, 5.15.156, 6.1.87, 6.6.28, 6.8.7

Technical data

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

CWE

CWE-787