In the Linux kernel, the following vulnerability has been resolved:
netrom: check buffer length before accessing it
Syzkaller reports an uninit value read from ax25cmp when sending raw message through ieee802154 implementation.
===================================================== BUG: KMSAN: uninit-value in ax25cmp+0x3a5/0x460 net/ax25/ax25_addr.c:119 ax25cmp+0x3a5/0x460 net/ax25/ax25_addr.c:119 nr_dev_get+0x20e/0x450 net/netrom/nr_route.c:601 nr_route_frame+0x1a2/0xfc0 net/netrom/nr_route.c:774 nr_xmit+0x5a/0x1c0 net/netrom/nr_dev.c:144 __netdev_start_xmit include/linux/netdevice.h:4940 [inline] netdev_start_xmit include/linux/netdevice.h:4954 [inline] xmit_one net/core/dev.c:3548 [inline] dev_hard_start_xmit+0x247/0xa10 net/core/dev.c:3564 __dev_queue_xmit+0x33b8/0x5130 net/core/dev.c:4349 dev_queue_xmit include/linux/netdevice.h:3134 [inline] raw_sendmsg+0x654/0xc10 net/ieee802154/socket.c:299 ieee802154_sock_sendmsg+0x91/0xc0 net/ieee802154/socket.c:96 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg net/socket.c:745 [inline] ____sys_sendmsg+0x9c2/0xd60 net/socket.c:2584 ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2638 __sys_sendmsg net/socket.c:2667 [inline] __do_sys_sendmsg net/socket.c:2676 [inline] __se_sys_sendmsg net/socket.c:2674 [inline] __x64_sys_sendmsg+0x307/0x490 net/socket.c:2674 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0x44/0x110 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b
Uninit was created at: slab_post_alloc_hook+0x129/0xa70 mm/slab.h:768 slab_alloc_node mm/slub.c:3478 [inline] kmem_cache_alloc_node+0x5e9/0xb10 mm/slub.c:3523 kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:560 __alloc_skb+0x318/0x740 net/core/skbuff.c:651 alloc_skb include/linux/skbuff.h:1286 [inline] alloc_skb_with_frags+0xc8/0xbd0 net/core/skbuff.c:6334 sock_alloc_send_pskb+0xa80/0xbf0 net/core/sock.c:2780 sock_alloc_send_skb include/net/sock.h:1884 [inline] raw_sendmsg+0x36d/0xc10 net/ieee802154/socket.c:282 ieee802154_sock_sendmsg+0x91/0xc0 net/ieee802154/socket.c:96 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg net/socket.c:745 [inline] ____sys_sendmsg+0x9c2/0xd60 net/socket.c:2584 ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2638 __sys_sendmsg net/socket.c:2667 [inline] __do_sys_sendmsg net/socket.c:2676 [inline] __se_sys_sendmsg net/socket.c:2674 [inline] __x64_sys_sendmsg+0x307/0x490 net/socket.c:2674 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0x44/0x110 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b
CPU: 0 PID: 5037 Comm: syz-executor166 Not tainted 6.7.0-rc7-syzkaller-00003-gfbafc3e621c3 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023 =====================================================
This issue occurs because the skb buffer is too small, and it's actual allocation is aligned. This hides an actual issue, which is that nr_route_frame does not validate the buffer size before using it.
Fix this issue by checking skb->len before accessing any fields in skb->data.
Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
CVSS Details
- CVSS 3.1 Base Score: 9.4
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux-6.1Upgrade linux | Feb 10, 2025 | Jan 15, 2025 |
| Ubuntu | — | Upgrade linux-image-6.11.0-1011-lowlatencyUpgrade linux-image-5.4.0-1129-raspiUpgrade linux-image-gkeop-6.8Upgrade linux-image-5.4.0-1116-fipsUpgrade linux-image-6.8.0-60-lowlatency-64kUpgrade linux-image-6.11.0-1013-oracle-64kUpgrade linux-image-5.15.0-136-genericUpgrade linux-image-6.11.0-1010-raspiUpgrade linux-image-nvidia-tegra-igxUpgrade linux-image-5.15.0-135-generic-lpaeUpgrade linux-image-5.15.0-1074-nvidia-lowlatencyUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-azure-fipsUpgrade linux-image-fipsUpgrade linux-image-6.8.0-1028-raspiUpgrade linux-image-6.8.0-60-generic-64kUpgrade linux-image-azure-lts-20.04Upgrade linux-image-azure-cvmUpgrade linux-image-6.11.0-1012-azure-fdeUpgrade linux-image-azure-lts-24.04Upgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-oracleUpgrade linux-image-6.8.0-1029-azure-fdeUpgrade linux-image-gcp-64k-lts-24.04Upgrade linux-image-6.8.0-1028-nvidia-lowlatencyUpgrade linux-image-6.8.0-1026-oracle-64kUpgrade linux-image-5.15.0-136-generic-64kUpgrade linux-image-raspi-hwe-18.04Upgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-5.15.0-1062-gkeopUpgrade linux-image-6.11.0-1011-lowlatency-64kUpgrade linux-image-6.8.0-1025-gkeUpgrade linux-image-gcp-lts-22.04Upgrade linux-image-ibm-lts-24.04Upgrade linux-image-oracle-64k-lts-24.04Upgrade linux-image-azure-fdeUpgrade linux-image-kvmUpgrade linux-image-oracle-lts-20.04Upgrade linux-image-6.11.0-1011-gcp-64kUpgrade linux-image-nvidia-64k-6.8Upgrade linux-image-6.8.0-2023-raspi-realtimeUpgrade linux-image-6.8.0-1016-azure-nvidiaUpgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-virtual-hwe-18.04Upgrade linux-image-oemUpgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-6.8.0-60-genericUpgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-raspi-nolpaeUpgrade linux-image-6.11.0-1012-azureUpgrade linux-image-5.4.0-211-generic-lpaeUpgrade linux-image-nvidia-tegra-rtUpgrade linux-image-5.4.0-1048-iotUpgrade linux-image-oem-24.04bUpgrade linux-image-5.15.0-1080-aws-fipsUpgrade linux-image-awsUpgrade linux-image-5.4.0-1060-xilinx-zynqmpUpgrade linux-image-ibm-classicUpgrade linux-image-aws-lts-20.04Upgrade linux-image-gcp-lts-20.04Upgrade linux-image-6.11.0-1017-oemUpgrade linux-image-gcp-fipsUpgrade linux-image-6.8.0-1026-ibmUpgrade linux-image-bluefieldUpgrade linux-image-5.15.0-135-fipsUpgrade linux-image-generic-lpaeUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-azure-fde-lts-24.04Upgrade linux-image-gcp-lts-24.04Upgrade linux-image-5.15.0-1081-gcpUpgrade linux-image-nvidia-6.8Upgrade linux-image-5.15.0-1074-ibmUpgrade linux-image-6.11.0-1011-awsUpgrade linux-image-6.8.0-1028-oemUpgrade linux-image-gkeop-5.15Upgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-6.11.0-21-genericUpgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-realtimeUpgrade linux-image-aws-fipsUpgrade linux-image-aws-lts-22.04Upgrade linux-image-virtual-hwe-20.04Upgrade linux-image-6.8.0-1029-awsUpgrade linux-image-5.4.0-1088-ibmUpgrade linux-image-virtualUpgrade linux-image-raspi2Upgrade linux-image-generic-hwe-18.04Upgrade linux-image-ibmUpgrade linux-image-5.4.0-1145-gcp-fipsUpgrade linux-image-6.11.0-21-generic-64kUpgrade linux-image-5.15.0-1021-nvidia-tegra-igxUpgrade linux-image-6.11.0-1013-oracleUpgrade linux-image-gke-5.15Upgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-oem-20.04Upgrade linux-image-oem-22.04cUpgrade linux-image-lowlatency-64kUpgrade linux-image-intel-iotgUpgrade linux-image-5.15.0-1033-nvidia-tegra-rtUpgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-5.15.0-1075-intel-iotgUpgrade linux-image-realtime-hwe-24.04Upgrade linux-image-nvidia-64kUpgrade linux-image-gkeUpgrade linux-image-gcpUpgrade linux-image-5.4.0-1145-gcpUpgrade linux-image-5.15.0-1084-azureUpgrade linux-image-5.15.0-1079-gcp-fipsUpgrade linux-image-6.11.0-1007-realtimeUpgrade linux-image-5.4.0-1129-kvmUpgrade linux-image-5.15.0-1073-intel-iot-realtimeUpgrade linux-image-5.15.0-1076-kvmUpgrade linux-image-5.15.0-135-lowlatencyUpgrade linux-image-oem-24.04Upgrade linux-image-5.4.0-1101-bluefieldUpgrade linux-image-raspiUpgrade linux-image-intel-iot-realtimeUpgrade linux-image-5.15.0-1079-gcpUpgrade linux-image-snapdragon-hwe-18.04Upgrade linux-image-generic-hwe-20.04Upgrade linux-image-6.8.0-1030-gcp-64kUpgrade linux-image-6.8.0-1029-azureUpgrade linux-image-5.4.0-211-genericUpgrade linux-image-aws-lts-24.04Upgrade linux-image-6.8.1-1022-realtimeUpgrade linux-image-5.4.0-1142-aws-fipsUpgrade linux-image-5.15.0-1080-awsUpgrade linux-image-5.15.0-1072-ibmUpgrade linux-image-ibm-lts-20.04Upgrade linux-image-5.15.0-1044-xilinx-zynqmpUpgrade linux-image-oracle-lts-24.04Upgrade linux-image-oem-20.04dUpgrade linux-image-lowlatencyUpgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-oem-22.04Upgrade linux-image-nvidiaUpgrade linux-image-azure-nvidiaUpgrade linux-image-5.4.0-1147-azureUpgrade linux-image-5.15.0-1077-oracleUpgrade linux-image-5.15.0-1077-intel-iotgUpgrade linux-image-oracle-64kUpgrade linux-image-oem-osp1Upgrade linux-image-6.8.0-1012-gkeopUpgrade linux-image-5.4.0-1142-awsUpgrade linux-image-6.8.0-1028-nvidia-lowlatency-64kUpgrade linux-image-intelUpgrade linux-image-lowlatency-hwe-24.04Upgrade linux-image-nvidia-tegra-igx-rtUpgrade linux-image-generic-hwe-22.04Upgrade linux-image-5.15.0-136-generic-lpaeUpgrade linux-image-oem-20.04bUpgrade linux-image-virtual-hwe-22.04Upgrade linux-image-5.15.0-135-generic-64kUpgrade linux-image-5.15.0-1083-azure-fipsUpgrade linux-image-5.15.0-1074-nvidiaUpgrade linux-image-5.15.0-1033-nvidia-tegraUpgrade linux-image-oem-24.04aUpgrade linux-image-6.8.0-1028-nvidiaUpgrade linux-image-5.15.0-1074-raspiUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-gkeopUpgrade linux-image-oem-22.04aUpgrade linux-image-5.4.0-1090-ibmUpgrade linux-image-5.4.0-1147-azure-fipsUpgrade linux-image-6.8.0-1026-oracleUpgrade linux-image-gcp-64kUpgrade linux-image-5.15.0-135-genericUpgrade linux-image-oem-20.04cUpgrade linux-image-oem-22.04dUpgrade linux-image-generic-64kUpgrade linux-image-5.15.0-1086-azureUpgrade linux-image-lowlatency-64k-hwe-24.04Upgrade linux-image-6.8.0-1030-gcpUpgrade linux-image-5.4.0-211-lowlatencyUpgrade linux-image-5.4.0-1140-oracleUpgrade linux-image-5.15.0-1077-gkeUpgrade linux-image-5.15.0-1080-realtimeUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-nvidia-tegraUpgrade linux-image-5.15.0-1021-nvidia-tegra-igx-rtUpgrade linux-image-lowlatency-hwe-18.04Upgrade linux-image-6.11.0-1011-gcpUpgrade linux-image-azureUpgrade linux-image-azure-lts-22.04Upgrade linux-image-6.8.0-60-lowlatencyUpgrade linux-image-raspi-realtimeUpgrade linux-image-5.15.0-135-lowlatency-64kUpgrade linux-image-xilinx-zynqmpUpgrade linux-image-5.15.0-1086-azure-fdeUpgrade linux-image-genericUpgrade linux-image-oem-22.04bUpgrade linux-image-6.8.0-1028-nvidia-64kUpgrade linux-image-oracle-lts-22.04 | Mar 28, 2025 | Jan 15, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Oct 13, 2025 | Jan 15, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub