Description
In the Linux kernel, the following vulnerability has been resolved: netlink: add nla be16/32 types to minlen array BUG: KMSAN: uninit-value in nla_validate_range_unsigned lib/nlattr.c:222 [inline] BUG: KMSAN: uninit-value in nla_validate_int_range lib/nlattr.c:336 [inline] BUG: KMSAN: uninit-value in validate_nla lib/nlattr.c:575 [inline] BUG: KMSAN: uninit-value in __nla_validate_parse+0x2e20/0x45c0 lib/nlattr.c:631 nla_validate_range_unsigned lib/nlattr.c:222 [inline] nla_validate_int_range lib/nlattr.c:336 [inline] validate_nla lib/nlattr.c:575 [inline] ... The message in question matches this policy: [NFTA_TARGET_REV] = NLA_POLICY_MAX(NLA_BE32, 255), but because NLA_BE32 size in minlen array is 0, the validation code will read past the malformed (too small) attribute. Note: Other attributes, e.g. BITFIELD32, SINT, UINT.. are also missing: those likely should be added too.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
24ea1c8abaae6541ad95912422a9af4fb858428d to < 000a68159c0326b46c42ec712ab98793e7e625a7affectedcbfac0add2afe8960a09806012313765a2179423 to < 80b40f9cb87f3bf5877dfb852765cf92bc03ca77affectedecaf75ffd5f5db320d8b1da0198eef5a5ce64a3f to < 0ac219c4c3ab253f3981f346903458d20bacab32affectedecaf75ffd5f5db320d8b1da0198eef5a5ce64a3f to < a2ab028151841cd833cb53eb99427e0cc990112daffectedecaf75ffd5f5db320d8b1da0198eef5a5ce64a3f to < 7a9d14c63b35f89563c5ecbadf918ad64979712daffectedecaf75ffd5f5db320d8b1da0198eef5a5ce64a3f to < 9a0d18853c280f6a0ee99f91619f2442a17a323aaffected
Linux Linux
Default version status: affected
6.1affected0 to < 6.1unaffected6.1.81 to ≤ 6.1.*unaffected6.6.21 to ≤ 6.6.*unaffected6.7.9 to ≤ 6.7.*unaffected6.8 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/000a68159c0326b46c42ec712ab98793e7e625a7 ↗
- https://git.kernel.org/stable/c/80b40f9cb87f3bf5877dfb852765cf92bc03ca77 ↗
- https://git.kernel.org/stable/c/0ac219c4c3ab253f3981f346903458d20bacab32 ↗
- https://git.kernel.org/stable/c/a2ab028151841cd833cb53eb99427e0cc990112d ↗
- https://git.kernel.org/stable/c/7a9d14c63b35f89563c5ecbadf918ad64979712d ↗
- https://git.kernel.org/stable/c/9a0d18853c280f6a0ee99f91619f2442a17a323a ↗