CVE-2024-50033

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

slip: make slhc_remember() more robust against malicious packets

syzbot found that slhc_remember() was missing checks against

malicious packets [1].

slhc_remember() only checked the size of the packet was at least 20,

which is not good enough.

We need to make sure the packet includes the IPv4 and TCP header

that are supposed to be carried.

Add iph and th pointers to make the code more readable.

[1]

BUG: KMSAN: uninit-value in slhc_remember+0x2e8/0x7b0 drivers/net/slip/slhc.c:666

slhc_remember+0x2e8/0x7b0 drivers/net/slip/slhc.c:666

ppp_receive_nonmp_frame+0xe45/0x35e0 drivers/net/ppp/ppp_generic.c:2455

ppp_receive_frame drivers/net/ppp/ppp_generic.c:2372 [inline]

ppp_do_recv+0x65f/0x40d0 drivers/net/ppp/ppp_generic.c:2212

ppp_input+0x7dc/0xe60 drivers/net/ppp/ppp_generic.c:2327

pppoe_rcv_core+0x1d3/0x720 drivers/net/ppp/pppoe.c:379

sk_backlog_rcv+0x13b/0x420 include/net/sock.h:1113

__release_sock

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References