linux-cve-announce - CVE-2024-56650: netfilter: x_tables: fix LED ID check in led_tg

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <2024122740-CVE-2024-56650-4d51@gregkh>
Date: Fri, 27 Dec 2024 16:02:51 +0100
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Subject: CVE-2024-56650: netfilter: x_tables: fix LED ID check in led_tg_check()

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

netfilter: x_tables: fix LED ID check in led_tg_check()

Syzbot has reported the following BUG detected by KASAN:

BUG: KASAN: slab-out-of-bounds in strlen+0x58/0x70
Read of size 1 at addr ffff8881022da0c8 by task repro/5879
...
Call Trace:
 <TASK>
 dump_stack_lvl+0x241/0x360
 ? __pfx_dump_stack_lvl+0x10/0x10
 ? __pfx__printk+0x10/0x10
 ? _printk+0xd5/0x120
 ? __virt_addr_valid+0x183/0x530
 ? __virt_addr_valid+0x183/0x530
 print_report+0x169/0x550
 ? __virt_addr_valid+0x183/0x530
 ? __virt_addr_valid+0x183/0x530
 ? __virt_addr_valid+0x45f/0x530
 ? __phys_addr+0xba/0x170
 ? strlen+0x58/0x70
 kasan_report+0x143/0x180
 ? strlen+0x58/0x70
 strlen+0x58/0x70
 kstrdup+0x20/0x80
 led_tg_check+0x18b/0x3c0
 xt_check_target+0x3bb/0xa40
 ? __pfx_xt_check_target+0x10/0x10
 ? stack_depot_save_flags+0x6e4/0x830
 ? nft_target_init+0x174/0xc30
 nft_target_init+0x82d/0xc30
 ? __pfx_nft_target_init+0x10/0x10
 ? nf_tables_newrule+0x1609/0x2980
 ? nf_tables_newrule+0x1609/0x2980
 ? rcu_is_watching+0x15/0xb0
 ? nf_tables_newrule+0x1609/0x2980
 ? nf_tables_newrule+0x1609/0x2980
 ? __kmalloc_noprof+0x21a/0x400
 nf_tables_newrule+0x1860/0x2980
 ? __pfx_nf_tables_newrule+0x10/0x10
 ? __nla_parse+0x40/0x60
 nfnetlink_rcv+0x14e5/0x2ab0
 ? __pfx_validate_chain+0x10/0x10
 ? __pfx_nfnetlink_rcv+0x10/0x10
 ? __lock_acquire+0x1384/0x2050
 ? netlink_deliver_tap+0x2e/0x1b0
 ? __pfx_lock_release+0x10/0x10
 ? netlink_deliver_tap+0x2e/0x1b0
 netlink_unicast+0x7f8/0x990
 ? __pfx_netlink_unicast+0x10/0x10
 ? __virt_addr_valid+0x183/0x530
 ? __check_object_size+0x48e/0x900
 netlink_sendmsg+0x8e4/0xcb0
 ? __pfx_netlink_sendmsg+0x10/0x10
 ? aa_sock_msg_perm+0x91/0x160
 ? __pfx_netlink_sendmsg+0x10/0x10
 __sock_sendmsg+0x223/0x270
 ____sys_sendmsg+0x52a/0x7e0
 ? __pfx_____sys_sendmsg+0x10/0x10
 __sys_sendmsg+0x292/0x380
 ? __pfx___sys_sendmsg+0x10/0x10
 ? lockdep_hardirqs_on_prepare+0x43d/0x780
 ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10
 ? exc_page_fault+0x590/0x8c0
 ? do_syscall_64+0xb6/0x230
 do_syscall_64+0xf3/0x230
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
...
 </TASK>

Since an invalid (without '\0' byte at all) byte sequence may be passed
from userspace, add an extra check to ensure that such a sequence is
rejected as possible ID and so never passed to 'kstrdup()' and further.

The Linux kernel CVE team has assigned CVE-2024-56650 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 2.6.30 with commit 268cb38e1802db560c73167e643f14a3dcb4b07c and fixed in 5.4.287 with commit 147a42bb02de8735cb08476be6d0917987d022c2
	Issue introduced in 2.6.30 with commit 268cb38e1802db560c73167e643f14a3dcb4b07c and fixed in 5.10.231 with commit ad28612ebae1fcc1104bd432e99e99d87f6bfe09
	Issue introduced in 2.6.30 with commit 268cb38e1802db560c73167e643f14a3dcb4b07c and fixed in 5.15.174 with commit 36a9d94dac28beef6b8abba46ba8874320d3e800
	Issue introduced in 2.6.30 with commit 268cb38e1802db560c73167e643f14a3dcb4b07c and fixed in 6.1.120 with commit ab9916321c95f5280b72b4c5055e269f98627efe
	Issue introduced in 2.6.30 with commit 268cb38e1802db560c73167e643f14a3dcb4b07c and fixed in 6.6.66 with commit a9bcc0b70d9baf3ff005874489a0dc9d023b54c3
	Issue introduced in 2.6.30 with commit 268cb38e1802db560c73167e643f14a3dcb4b07c and fixed in 6.12.5 with commit c40c96d98e536fc1daaa125c2332b988615e30a4
	Issue introduced in 2.6.30 with commit 268cb38e1802db560c73167e643f14a3dcb4b07c and fixed in 6.13-rc2 with commit 04317f4eb2aad312ad85c1a17ad81fe75f1f9bc7

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2024-56650
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/netfilter/xt_LED.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/147a42bb02de8735cb08476be6d0917987d022c2
	https://git.kernel.org/stable/c/ad28612ebae1fcc1104bd432e99e99d87f6bfe09
	https://git.kernel.org/stable/c/36a9d94dac28beef6b8abba46ba8874320d3e800
	https://git.kernel.org/stable/c/ab9916321c95f5280b72b4c5055e269f98627efe
	https://git.kernel.org/stable/c/a9bcc0b70d9baf3ff005874489a0dc9d023b54c3
	https://git.kernel.org/stable/c/c40c96d98e536fc1daaa125c2332b988615e30a4
	https://git.kernel.org/stable/c/04317f4eb2aad312ad85c1a17ad81fe75f1f9bc7