CVE-2024-26805

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

netlink: Fix kernel-infoleak-after-free in __skb_datagram_iter

syzbot reported the following uninit-value access issue [1]:

netlink_to_full_skb() creates a new `skb` and puts the `skb->data`

passed as a 1st arg of netlink_to_full_skb() onto new `skb`. The data

size is specified as `len` and passed to skb_put_data(). This `len`

is based on `skb->end` that is not data offset but buffer offset. The

`skb->end` contains data and tailroom. Since the tailroom is not

initialized when the new `skb` created, KMSAN detects uninitialized

memory area when copying the data.

This patch resolved this issue by correct the len from `skb->end` to

`skb->len`, which is the actual data offset.

BUG: KMSAN: kernel-infoleak-after-free in instrument_copy_to_user include/linux/instrumented.h:114 [inline]

BUG: KMSAN: kernel-infoleak-after-free in copy_to_user_iter lib/iov_iter.c:24 [inline]

BUG: KMSAN: kernel-infoleak-after-free in iterate_u

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References