CVE-2024-36927

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ipv4: Fix uninit-value access in __ip_make_skb()

KMSAN reported uninit-value access in __ip_make_skb() [1]. __ip_make_skb()

tests HDRINCL to know if the skb has icmphdr. However, HDRINCL can cause a

race condition. If calling setsockopt(2) with IP_HDRINCL changes HDRINCL

while __ip_make_skb() is running, the function will access icmphdr in the

skb even if it is not included. This causes the issue reported by KMSAN.

Check FLOWI_FLAG_KNOWN_NH on fl4->flowi4_flags instead of testing HDRINCL

on the socket.

Also, fl4->fl4_icmp_type and fl4->fl4_icmp_code are not initialized. These

are union in struct flowi4 and are implicitly initialized by

flowi4_init_output(), but we should not rely on specific union layout.

Initialize these explicitly in raw_sendmsg().

[1]

BUG: KMSAN: uninit-value in __ip_make_skb+0x2b74/0x2d20 net/ipv4/ip_output.c:1481

__ip_make_skb+0x2b74/0x2d20 net/ipv4/ip_output.c:1481

ip_finish_skb include/

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References