linux-cve-announce - CVE-2024-53066: nfs: Fix KMSAN warning in decode_getfattr

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2024111932-CVE-2024-53066-abf7@gregkh>
Date: Tue, 19 Nov 2024 18:22:37 +0100
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Subject: CVE-2024-53066: nfs: Fix KMSAN warning in decode_getfattr_attrs()

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

nfs: Fix KMSAN warning in decode_getfattr_attrs()

Fix the following KMSAN warning:

CPU: 1 UID: 0 PID: 7651 Comm: cp Tainted: G    B
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009)
=====================================================
=====================================================
BUG: KMSAN: uninit-value in decode_getfattr_attrs+0x2d6d/0x2f90
 decode_getfattr_attrs+0x2d6d/0x2f90
 decode_getfattr_generic+0x806/0xb00
 nfs4_xdr_dec_getattr+0x1de/0x240
 rpcauth_unwrap_resp_decode+0xab/0x100
 rpcauth_unwrap_resp+0x95/0xc0
 call_decode+0x4ff/0xb50
 __rpc_execute+0x57b/0x19d0
 rpc_execute+0x368/0x5e0
 rpc_run_task+0xcfe/0xee0
 nfs4_proc_getattr+0x5b5/0x990
 __nfs_revalidate_inode+0x477/0xd00
 nfs_access_get_cached+0x1021/0x1cc0
 nfs_do_access+0x9f/0xae0
 nfs_permission+0x1e4/0x8c0
 inode_permission+0x356/0x6c0
 link_path_walk+0x958/0x1330
 path_lookupat+0xce/0x6b0
 filename_lookup+0x23e/0x770
 vfs_statx+0xe7/0x970
 vfs_fstatat+0x1f2/0x2c0
 __se_sys_newfstatat+0x67/0x880
 __x64_sys_newfstatat+0xbd/0x120
 x64_sys_call+0x1826/0x3cf0
 do_syscall_64+0xd0/0x1b0
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

The KMSAN warning is triggered in decode_getfattr_attrs(), when calling
decode_attr_mdsthreshold(). It appears that fattr->mdsthreshold is not
initialized.

Fix the issue by initializing fattr->mdsthreshold to NULL in
nfs_fattr_init().

The Linux kernel CVE team has assigned CVE-2024-53066 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 3.5 with commit 88034c3d88c2 and fixed in 4.19.324 with commit 25ffd294fef8
	Issue introduced in 3.5 with commit 88034c3d88c2 and fixed in 5.4.286 with commit bbfcd261cc06
	Issue introduced in 3.5 with commit 88034c3d88c2 and fixed in 5.10.230 with commit 8fc5ea9231af
	Issue introduced in 3.5 with commit 88034c3d88c2 and fixed in 5.15.172 with commit 9b453e8b108a
	Issue introduced in 3.5 with commit 88034c3d88c2 and fixed in 6.1.117 with commit f6b2b2b981af
	Issue introduced in 3.5 with commit 88034c3d88c2 and fixed in 6.6.61 with commit f749cb60a01f
	Issue introduced in 3.5 with commit 88034c3d88c2 and fixed in 6.11.8 with commit 9be0a21ae52b
	Issue introduced in 3.5 with commit 88034c3d88c2 and fixed in 6.12 with commit dc270d715969

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2024-53066
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	fs/nfs/inode.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/25ffd294fef81a7f3cd9528adf21560c04d98747
	https://git.kernel.org/stable/c/bbfcd261cc068fe1cd02a4e871275074a0daa4e2
	https://git.kernel.org/stable/c/8fc5ea9231af9122d227c9c13f5e578fca48d2e3
	https://git.kernel.org/stable/c/9b453e8b108a5a93a6e348cf2ba4c9c138314a00
	https://git.kernel.org/stable/c/f6b2b2b981af8e7d7c62d34143acefa4e1edfe8b
	https://git.kernel.org/stable/c/f749cb60a01f8391c760a1d6ecd938cadacf9549
	https://git.kernel.org/stable/c/9be0a21ae52b3b822d0eec4d14e909ab394f8a92
	https://git.kernel.org/stable/c/dc270d7159699ad6d11decadfce9633f0f71c1db