CVE-2021-47297

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: fix uninit-value in caif_seqpkt_sendmsg

When nr_segs equal to zero in iovec_from_user, the object

msg->msg_iter.iov is uninit stack memory in caif_seqpkt_sendmsg

which is defined in ___sys_sendmsg. So we cann't just judge

msg->msg_iter.iov->base directlly. We can use nr_segs to judge

msg in caif_seqpkt_sendmsg whether has data buffers.

=====================================================

BUG: KMSAN: uninit-value in caif_seqpkt_sendmsg+0x693/0xf60 net/caif/caif_socket.c:542

Call Trace:

__dump_stack lib/dump_stack.c:77 [inline]

dump_stack+0x1c9/0x220 lib/dump_stack.c:118

kmsan_report+0xf7/0x1e0 mm/kmsan/kmsan_report.c:118

__msan_warning+0x58/0xa0 mm/kmsan/kmsan_instr.c:215

caif_seqpkt_sendmsg+0x693/0xf60 net/caif/caif_socket.c:542

sock_sendmsg_nosec net/socket.c:652 [inline]

sock_sendmsg net/socket.c:672 [inline]

____sys_sendmsg+0x12b6/0x1350 net/socket.c:2343

___sys_sendmsg net/socket.c:2397 [inline]

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References