CVE-2024-26635

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

llc: Drop support for ETH_P_TR_802_2.

syzbot reported an uninit-value bug below. [0]

llc supports ETH_P_802_2 (0x0004) and used to support ETH_P_TR_802_2

(0x0011), and syzbot abused the latter to trigger the bug.

write$tun(r0, &(0x7f0000000040)={@val={0x0, 0x11}, @val, @mpls={[], @llc={@snap={0xaa, 0x1, ')', "90e5dd"}}}}, 0x16)

llc_conn_handler() initialises local variables {saddr,daddr}.mac

based on skb in llc_pdu_decode_sa()/llc_pdu_decode_da() and passes

them to __llc_lookup().

However, the initialisation is done only when skb->protocol is

htons(ETH_P_802_2), otherwise, __llc_lookup_established() and

__llc_lookup_listener() will read garbage.

The missing initialisation existed prior to commit 211ed865108e

("net: delete all instances of special processing for token ring").

It removed the part to kick out the token ring stuff but forgot to

close the door allowing ETH_P_TR_802_2 packets to sneak into llc_rcv(

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References