Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2024-36927— ipv4: Fix uninit-value access in __ip_make_skb()

AI Predicted 5.5 Difficulty: Moderate EPSS 0.17% · P6

Affected Version Matrix 27

VendorProductVersion RangeStatus
LinuxLinux566785731c6dd41ef815196ddc36d1ae30a63763< 88c66f1879f322f11de34d37b2d3d87497afdcb6affected
a54ec573d9b81b05d368f8e6edc1b3e49f688658< 20d3eb00ab81462d554ac6d09691b8d9aa5a5741affected
fc60067260c20da8cddcf968bec47416f3e2cde2< 55bf541e018b76b3750cb6c6ea18c46e1ac5562eaffected
99e5acae193e369b71217efe6f1dad42f3f18815< 5db08343ddb1b239320612036c398e4e1bb52818affected
99e5acae193e369b71217efe6f1dad42f3f18815< f5c603ad4e6fcf42f84053e882ebe20184bb309eaffected
99e5acae193e369b71217efe6f1dad42f3f18815< fc1092f51567277509563800a3c56732070b6aa4affected
dc4e3bb0710178c8d03fc43064e0a71fe7440cddaffected
022ea4374c319690c804706bda9dc42946d1556daffected
… +19 more rows
Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2024-36927

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
ipv4: Fix uninit-value access in __ip_make_skb()
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: ipv4: Fix uninit-value access in __ip_make_skb() KMSAN reported uninit-value access in __ip_make_skb() [1]. __ip_make_skb() tests HDRINCL to know if the skb has icmphdr. However, HDRINCL can cause a race condition. If calling setsockopt(2) with IP_HDRINCL changes HDRINCL while __ip_make_skb() is running, the function will access icmphdr in the skb even if it is not included. This causes the issue reported by KMSAN. Check FLOWI_FLAG_KNOWN_NH on fl4->flowi4_flags instead of testing HDRINCL on the socket. Also, fl4->fl4_icmp_type and fl4->fl4_icmp_code are not initialized. These are union in struct flowi4 and are implicitly initialized by flowi4_init_output(), but we should not rely on specific union layout. Initialize these explicitly in raw_sendmsg(). [1] BUG: KMSAN: uninit-value in __ip_make_skb+0x2b74/0x2d20 net/ipv4/ip_output.c:1481 __ip_make_skb+0x2b74/0x2d20 net/ipv4/ip_output.c:1481 ip_finish_skb include/net/ip.h:243 [inline] ip_push_pending_frames+0x4c/0x5c0 net/ipv4/ip_output.c:1508 raw_sendmsg+0x2381/0x2690 net/ipv4/raw.c:654 inet_sendmsg+0x27b/0x2a0 net/ipv4/af_inet.c:851 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x274/0x3c0 net/socket.c:745 __sys_sendto+0x62c/0x7b0 net/socket.c:2191 __do_sys_sendto net/socket.c:2203 [inline] __se_sys_sendto net/socket.c:2199 [inline] __x64_sys_sendto+0x130/0x200 net/socket.c:2199 do_syscall_64+0xd8/0x1f0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x6d/0x75 Uninit was created at: slab_post_alloc_hook mm/slub.c:3804 [inline] slab_alloc_node mm/slub.c:3845 [inline] kmem_cache_alloc_node+0x5f6/0xc50 mm/slub.c:3888 kmalloc_reserve+0x13c/0x4a0 net/core/skbuff.c:577 __alloc_skb+0x35a/0x7c0 net/core/skbuff.c:668 alloc_skb include/linux/skbuff.h:1318 [inline] __ip_append_data+0x49ab/0x68c0 net/ipv4/ip_output.c:1128 ip_append_data+0x1e7/0x260 net/ipv4/ip_output.c:1365 raw_sendmsg+0x22b1/0x2690 net/ipv4/raw.c:648 inet_sendmsg+0x27b/0x2a0 net/ipv4/af_inet.c:851 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x274/0x3c0 net/socket.c:745 __sys_sendto+0x62c/0x7b0 net/socket.c:2191 __do_sys_sendto net/socket.c:2203 [inline] __se_sys_sendto net/socket.c:2199 [inline] __x64_sys_sendto+0x130/0x200 net/socket.c:2199 do_syscall_64+0xd8/0x1f0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x6d/0x75 CPU: 1 PID: 15709 Comm: syz-executor.7 Not tainted 6.8.0-11567-gb3603fcb79b1 #25 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-1.fc39 04/01/2014
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于__ip_make_skb()存在安全漏洞。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

VendorProductAffected VersionsCPESubscribe
LinuxLinux 566785731c6dd41ef815196ddc36d1ae30a63763 ~ 88c66f1879f322f11de34d37b2d3d87497afdcb6 -
LinuxLinux 6.4 -

II. Public POCs for CVE-2024-36927

#POC DescriptionSource LinkShenlong Link
AI-Generated POCPremium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2024-36927

请登录查看更多情报信息。

Patches & Fixes for CVE-2024-36927 (1)

Other References for CVE-2024-36927 (1)

Same Patch Batch · Linux · 2024-05-30 · 93 CVEs total

CVE-2024-36925swiotlb: initialise restricted pool list_head when SWIOTLB_DYNAMIC=y
CVE-2024-36921wifi: iwlwifi: mvm: guard against invalid STA ID on removal
CVE-2024-36918bpf: Check bloom filter map value size
CVE-2024-36917block: fix overflow in blk_ioctl_discard()
CVE-2024-36914drm/amd/display: Skip on writeback when it's not applicable
CVE-2024-36915nfc: llcp: fix nfc_llcp_setsockopt() unsafe copies
CVE-2024-36913Drivers: hv: vmbus: Leak pages if set_memory_encrypted() fails
CVE-2024-36912Drivers: hv: vmbus: Track decrypted status in vmbus_gpadl
CVE-2024-36916blk-iocost: avoid out of bounds shift
CVE-2024-36924scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up()
CVE-2024-36922wifi: iwlwifi: read txq->read_ptr under lock
CVE-2024-36926powerpc/pseries/iommu: LPAR panics during boot up with a frozen PE
CVE-2024-36928s390/qeth: Fix kernel panic after setting hsuid
CVE-2024-36929net: core: reject skb_copy(_expand) for fraglist GSO skbs
CVE-2024-36930spi: fix null pointer dereference within spi_sync
CVE-2024-36932thermal/debugfs: Prevent use-after-free from occurring after cdev removal
CVE-2024-36931s390/cio: Ensure the copied buf is NUL terminated
CVE-2024-36933nsh: Restore skb->{protocol,data,mac_header} for outer header in nsh_gso_segment().
CVE-2024-36934bna: ensure the copied buf is NUL terminated
CVE-2024-36935ice: ensure the copied buf is NUL terminated

Showing top 20 of 93 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2024-36927

No comments yet

Leave a comment