CVE-2023-52700

tipc: fix kernel warning when sending SYN message

Medium · published May 21, 2024

CVSS v3.1
5.5
EPSS
0%
Percentile
11.6
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

tipc: fix kernel warning when sending SYN message

When sending a SYN message, this kernel stack trace is observed:

...

[ 13.396352] RIP: 0010:_copy_from_iter+0xb4/0x550

...

[ 13.398494] Call Trace:

[ 13.398630] <TASK>

[ 13.398630] ? __alloc_skb+0xed/0x1a0

[ 13.398630] tipc_msg_build+0x12c/0x670 [tipc]

[ 13.398630] ? shmem_add_to_page_cache.isra.71+0x151/0x290

[ 13.398630] __tipc_sendmsg+0x2d1/0x710 [tipc]

[ 13.398630] ? tipc_connect+0x1d9/0x230 [tipc]

[ 13.398630] ? __local_bh_enable_ip+0x37/0x80

[ 13.398630] tipc_connect+0x1d9/0x230 [tipc]

[ 13.398630] ? __sys_connect+0x9f/0xd0

[ 13.398630] __sys_connect+0x9f/0xd0

[ 13.398630] ? preempt_count_add+0x4d/0xa0

[ 13.398630] ? fpregs_assert_state_consistent+0x22/0x50

[ 13.398630] __x64_sys_connect+0x16/0x20

[ 13.398630] do_syscall_64+0x42/0x90

[ 13.398630] entry_SYSCALL_64_after_hwframe+0x63/0xcd

It is because commit a41dad905e5a ("iov_iter: saner checks for attempt

to copy to/from iterator") has introduced sanity check for copying

from/to iov iterator. Lacking of copy direction from the iterator

viewpoint would lead to kernel stack trace like above.

This commit fixes this issue by initializing the iov iterator with

the correct copy direction when sending SYN or ACK without data.

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00217 · 11.6th percentile
Published
2024-05-21T15:22Z
EPSS history
Timeline
  • 21 MAY 15:22Z
    tipc: fix kernel warning when sending SYN message
    cvelistv5