CVE-2024-26849

netlink: add nla be16/32 types to minlen array

published April 17, 2024

CVSS
—
EPSS
0%
Percentile
12.2
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

netlink: add nla be16/32 types to minlen array

BUG: KMSAN: uninit-value in nla_validate_range_unsigned lib/nlattr.c:222 [inline]

BUG: KMSAN: uninit-value in nla_validate_int_range lib/nlattr.c:336 [inline]

BUG: KMSAN: uninit-value in validate_nla lib/nlattr.c:575 [inline]

BUG: KMSAN: uninit-value in __nla_validate_parse+0x2e20/0x45c0 lib/nlattr.c:631

nla_validate_range_unsigned lib/nlattr.c:222 [inline]

nla_validate_int_range lib/nlattr.c:336 [inline]

validate_nla lib/nlattr.c:575 [inline]

...

The message in question matches this policy:

[NFTA_TARGET_REV] = NLA_POLICY_MAX(NLA_BE32, 255),

but because NLA_BE32 size in minlen array is 0, the validation

code will read past the malformed (too small) attribute.

Note: Other attributes, e.g. BITFIELD32, SINT, UINT.. are also missing:

those likely should be added too.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00223 · 12.2th percentile
Published
2024-04-17T10:14Z
EPSS history
Timeline
  • 17 APR 10:14Z
    netlink: add nla be16/32 types to minlen array
    cvelistv5