In the Linux kernel, the following vulnerability has been resolved:
tipc: Check the bearer type before calling tipc_udp_nl_bearer_add()
syzbot reported the following general protection fault [1]:
general protection fault, probably for non-canonical address 0xdffffc0000000010: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000080-0x0000000000000087] ... RIP: 0010:tipc_udp_is_known_peer+0x9c/0x250 net/tipc/udp_media.c:291 ... Call Trace: <TASK> tipc_udp_nl_bearer_add+0x212/0x2f0 net/tipc/udp_media.c:646 tipc_nl_bearer_add+0x21e/0x360 net/tipc/bearer.c:1089 genl_family_rcv_msg_doit+0x1fc/0x2e0 net/netlink/genetlink.c:972 genl_family_rcv_msg net/netlink/genetlink.c:1052 [inline] genl_rcv_msg+0x561/0x800 net/netlink/genetlink.c:1067 netlink_rcv_skb+0x16b/0x440 net/netlink/af_netlink.c:2544 genl_rcv+0x28/0x40 net/netlink/genetlink.c:1076 netlink_unicast_kernel net/netlink/af_netlink.c:1341 [inline] netlink_unicast+0x53b/0x810 net/netlink/af_netlink.c:1367 netlink_sendmsg+0x8b7/0xd70 net/netlink/af_netlink.c:1909 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0xd5/0x180 net/socket.c:745 ____sys_sendmsg+0x6ac/0x940 net/socket.c:2584 ___sys_sendmsg+0x135/0x1d0 net/socket.c:2638 __sys_sendmsg+0x117/0x1e0 net/socket.c:2667 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0x40/0x110 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b
The cause of this issue is that when tipc_nl_bearer_add() is called with the TIPC_NLA_BEARER_UDP_OPTS attribute, tipc_udp_nl_bearer_add() is called even if the bearer is not UDP.
tipc_udp_is_known_peer() called by tipc_udp_nl_bearer_add() assumes that the media_ptr field of the tipc_bearer has an udp_bearer type object, so the function goes crazy for non-UDP bearers.
This patch fixes the issue by checking the bearer type before calling tipc_udp_nl_bearer_add() in tipc_nl_bearer_add().
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade bpftool-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade perfUpgrade kernel-develUpgrade kernel-livepatch-5.10.210-201.852Upgrade python-perfUpgrade kernel-toolsUpgrade bpftoolUpgrade kernel-tools-develUpgrade kernel-headersUpgrade python-perf-debuginfoUpgrade kernelUpgrade kernel-debuginfoUpgrade kernel-livepatch-4.14.343-259.562Upgrade kernel-tools-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade perf-debuginfo | Aug 19, 2024 | Apr 2, 2024 |
| Debian | — | Upgrade linux | May 8, 2024 | Apr 2, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade kernel-abi-stablelistsUpgrade kernelUpgrade kernel-toolsUpgrade python3-perfUpgrade kernel-tools-libs | Jul 16, 2024 | Apr 2, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade kernelUpgrade bpftoolUpgrade python3-perfUpgrade kernel-tools-libsUpgrade kernel-toolsUpgrade kernel-abi-stablelists | Jun 26, 2024 | Apr 2, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade kernel-abi-stablelistsUpgrade kernelUpgrade kernel-toolsUpgrade kernel-tools-libsUpgrade python3-perfUpgrade bpftool | Oct 8, 2024 | Apr 2, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade kernel-toolsUpgrade kernel-tools-libsUpgrade kernelUpgrade python3-perf | Jul 17, 2024 | Apr 2, 2024 |
| Redhat_linux | — | No solution existsUpgrade kernelUpgrade kernel-rt | Dec 5, 2024 | Apr 2, 2024 |
| Suse | — | Upgrade kernel-rt-develUpgrade dlm-kmp-defaultUpgrade kernel-devel-rtUpgrade kernel-default-extraUpgrade kernel-64kb-develUpgrade dtb-armUpgrade dtb-amlogicUpgrade ocfs2-kmp-rtUpgrade kernel-rt_debug-vdsoUpgrade dtb-rockchipUpgrade dtb-mediatekUpgrade kernel-debugUpgrade kernel-azure-livepatch-develUpgrade dtb-xilinxUpgrade dlm-kmp-azureUpgrade reiserfs-kmp-azureUpgrade kselftests-kmp-rtUpgrade kernel-defaultUpgrade dtb-apmUpgrade kernel-syms-rtUpgrade kernel-rt-livepatch-develUpgrade kernel-default-livepatch-develUpgrade kernel-symsUpgrade kernel-rt-livepatchUpgrade kernel-kvmsmallUpgrade kernel-default-optionalUpgrade cluster-md-kmp-64kbUpgrade kernel-default-base-rebuildUpgrade kernel-default-baseUpgrade kernel-debug-livepatch-develUpgrade kselftests-kmp-defaultUpgrade reiserfs-kmp-rtUpgrade kernel-azure-vdsoUpgrade dtb-renesasUpgrade dlm-kmp-rtUpgrade cluster-md-kmp-defaultUpgrade kernel-default-manUpgrade kernel-azure-develUpgrade kernel-docsUpgrade dtb-nvidiaUpgrade dtb-sprdUpgrade kernel-macrosUpgrade kernel-obs-qaUpgrade dtb-socionextUpgrade ocfs2-kmp-azureUpgrade kselftests-kmp-azureUpgrade kernel-kvmsmall-develUpgrade dtb-broadcomUpgrade gfs2-kmp-64kbUpgrade kernel-azure-optionalUpgrade dtb-lgUpgrade gfs2-kmp-rtUpgrade ocfs2-kmp-64kbUpgrade kernel-develUpgrade kernel-kvmsmall-livepatch-develUpgrade dtb-alteraUpgrade kernel-rt-vdsoUpgrade kernel-source-azureUpgrade kernel-rt-extraUpgrade reiserfs-kmp-defaultUpgrade kernel-azure-baseUpgrade kernel-debug-vdsoUpgrade kernel-default-vdsoUpgrade dtb-appleUpgrade gfs2-kmp-azureUpgrade kernel-syms-azureUpgrade kernel-64kbUpgrade kernel-64kb-extraUpgrade kernel-default-develUpgrade kernel-source-vanillaUpgrade dtb-marvellUpgrade kselftests-kmp-64kbUpgrade kernel-rtUpgrade kernel-64kb-livepatch-develUpgrade kernel-azureUpgrade dtb-hisiliconUpgrade kernel-debug-develUpgrade kernel-sourceUpgrade dlm-kmp-64kbUpgrade dtb-exynosUpgrade kernel-obs-buildUpgrade ocfs2-kmp-defaultUpgrade reiserfs-kmp-64kbUpgrade kernel-rt_debugUpgrade kernel-kvmsmall-vdsoUpgrade dtb-qcomUpgrade kernel-64kb-optionalUpgrade kernel-source-rtUpgrade kernel-rt_debug-develUpgrade gfs2-kmp-defaultUpgrade kernel-default-livepatchUpgrade dtb-allwinnerUpgrade dtb-caviumUpgrade dtb-freescaleUpgrade kernel-devel-azureUpgrade dtb-amdUpgrade kernel-docs-htmlUpgrade kernel-rt-optionalUpgrade kernel-zfcpdumpUpgrade cluster-md-kmp-azureUpgrade dtb-amazonUpgrade cluster-md-kmp-rtUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-azure-extra | Aug 8, 2024 | Apr 2, 2024 |
| Ubuntu | — | Upgrade linux-image-6.5.0-1023-nvidiaUpgrade linux-image-nvidia-6.5Upgrade linux-image-lowlatencyUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-ibm-lts-20.04Upgrade linux-image-5.4.0-1112-kvmUpgrade linux-image-5.15.0-106-lowlatencyUpgrade linux-image-6.5.0-1027-oemUpgrade linux-image-4.15.0-1170-gcpUpgrade linux-image-awsUpgrade linux-image-azure-cvmUpgrade linux-image-6.5.0-44-lowlatency-64kUpgrade linux-image-aws-lts-22.04Upgrade linux-image-6.5.0-1026-oracleUpgrade linux-image-oem-22.04dUpgrade linux-image-generic-hwe-20.04Upgrade linux-image-5.4.0-1128-gcpUpgrade linux-image-6.5.0-1024-azure-fdeUpgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-5.15.0-1054-ibmUpgrade linux-image-4.15.0-1139-oracleUpgrade linux-image-azureUpgrade linux-image-aws-hweUpgrade linux-image-6.5.0-1024-gcpUpgrade linux-image-5.15.0-1058-kvmUpgrade linux-image-5.4.0-1084-bluefieldUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-5.15.0-1063-azure-fdeUpgrade linux-image-raspi-nolpaeUpgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-5.15.0-1058-gkeUpgrade linux-image-generic-lpaeUpgrade linux-image-5.4.0-1123-oracleUpgrade linux-image-6.5.0-1017-starfiveUpgrade linux-image-oracle-lts-18.04Upgrade linux-image-azure-fdeUpgrade linux-image-gke-5.15Upgrade linux-image-4.15.0-1185-azureUpgrade linux-image-4.15.0-233-genericUpgrade linux-image-virtual-hwe-20.04Upgrade linux-image-5.15.0-1063-azureUpgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-5.15.0-106-generic-64kUpgrade linux-image-raspiUpgrade linux-image-oem-22.04aUpgrade linux-image-nvidia-64k-6.5Upgrade linux-image-aws-lts-20.04Upgrade linux-image-5.15.0-106-lowlatency-64kUpgrade linux-image-ibmUpgrade linux-image-kvmUpgrade linux-image-starfiveUpgrade linux-image-gcp-lts-22.04Upgrade linux-image-gkeop-5.4Upgrade linux-image-5.15.0-1059-gcpUpgrade linux-image-5.15.0-1044-gkeopUpgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-6.5.0-1026-oracle-64kUpgrade linux-image-5.15.0-1054-raspiUpgrade linux-image-5.4.0-1043-xilinx-zynqmpUpgrade linux-image-oem-20.04bUpgrade linux-image-5.15.0-1058-intel-iotgUpgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-5.4.0-1091-gkeopUpgrade linux-image-gcpUpgrade linux-image-oem-osp1Upgrade linux-image-generic-64kUpgrade linux-image-oem-20.04cUpgrade linux-image-oem-22.04bUpgrade linux-image-azure-lts-20.04Upgrade linux-image-6.5.0-1020-raspiUpgrade linux-image-6.5.0-44-genericUpgrade linux-image-5.4.0-1124-awsUpgrade linux-image-oem-22.04cUpgrade linux-image-oracle-lts-20.04Upgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-gkeop-5.15Upgrade linux-image-nvidiaUpgrade linux-image-oem-20.04Upgrade linux-image-azure-lts-18.04Upgrade linux-image-genericUpgrade linux-image-5.4.0-181-generic-lpaeUpgrade linux-image-virtualUpgrade linux-image-oracle-lts-22.04Upgrade linux-image-intel-iotgUpgrade linux-image-virtual-hwe-18.04Upgrade linux-image-aws-lts-18.04Upgrade linux-image-5.4.0-1129-azureUpgrade linux-image-6.5.0-1023-awsUpgrade linux-image-5.15.0-1054-nvidia-lowlatencyUpgrade linux-image-raspi2Upgrade linux-image-gcp-lts-18.04Upgrade linux-image-lowlatency-hwe-16.04Upgrade linux-image-5.4.0-181-lowlatencyUpgrade linux-image-oem-20.04dUpgrade linux-image-5.15.0-1059-oracleUpgrade linux-image-5.15.0-106-genericUpgrade linux-image-intelUpgrade linux-image-xilinx-zynqmpUpgrade linux-image-gkeUpgrade linux-image-azure-lts-22.04Upgrade linux-image-virtual-hwe-16.04Upgrade linux-image-6.5.0-1024-azureUpgrade linux-image-5.4.0-1071-ibmUpgrade linux-image-5.4.0-181-genericUpgrade linux-image-raspi-hwe-18.04Upgrade linux-image-5.15.0-106-generic-lpaeUpgrade linux-image-4.15.0-233-lowlatencyUpgrade linux-image-gkeopUpgrade linux-image-5.15.0-1054-nvidiaUpgrade linux-image-generic-hwe-18.04Upgrade linux-image-snapdragon-hwe-18.04Upgrade linux-image-5.4.0-1036-iotUpgrade linux-image-4.15.0-1160-kvmUpgrade linux-image-lowlatency-hwe-18.04Upgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-oem-22.04Upgrade linux-image-gcp-lts-20.04Upgrade linux-image-4.15.0-1177-awsUpgrade linux-image-6.5.0-1023-nvidia-64kUpgrade linux-image-lowlatency-64kUpgrade linux-image-5.15.0-1057-intel-iotgUpgrade linux-image-oracle-64kUpgrade linux-image-6.5.0-44-generic-64kUpgrade linux-image-virtual-hwe-22.04Upgrade linux-image-azure-fde-lts-22.04Upgrade linux-image-oracleUpgrade linux-image-6.5.0-44-lowlatencyUpgrade linux-image-bluefieldUpgrade linux-image-5.15.0-1061-awsUpgrade linux-image-5.4.0-1108-raspiUpgrade linux-image-generic-hwe-22.04Upgrade linux-image-oemUpgrade linux-image-generic-hwe-16.04 | May 17, 2024 | Apr 2, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Apr 2, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub