CVE-2024-42106

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

inet_diag: Initialize pad field in struct inet_diag_req_v2

KMSAN reported uninit-value access in raw_lookup() [1]. Diag for raw

sockets uses the pad field in struct inet_diag_req_v2 for the

underlying protocol. This field corresponds to the sdiag_raw_protocol

field in struct inet_diag_req_raw.

inet_diag_get_exact_compat() converts inet_diag_req to

inet_diag_req_v2, but leaves the pad field uninitialized. So the issue

occurs when raw_lookup() accesses the sdiag_raw_protocol field.

Fix this by initializing the pad field in

inet_diag_get_exact_compat(). Also, do the same fix in

inet_diag_dump_compat() to avoid the similar issue in the future.

[1]

BUG: KMSAN: uninit-value in raw_lookup net/ipv4/raw_diag.c:49 [inline]

BUG: KMSAN: uninit-value in raw_sock_get+0x657/0x800 net/ipv4/raw_diag.c:71

raw_lookup net/ipv4/raw_diag.c:49 [inline]

raw_sock_get+0x657/0x800 net/ipv4/raw_diag.c:71

raw_diag_dump_one+0xa1/0x660 net/i

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References