CVE-2024-56650: netfilter: x_tables: fix LED ID check in led_tg_check()
In the Linux kernel, the following vulnerability has been resolved:
netfilter: xtables: fix LED ID check in ledtgcheck()
Syzbot has reported the following BUG detected by KASAN:
BUG: KASAN: slab-out-of-bounds in strlen+0x58/0x70 Read of size 1 at addr ffff8881022da0c8 by task repro/5879 ... Call Trace: <TASK> dumpstacklvl+0x241/0x360 ? pfxdumpstacklvl+0x10/0x10 ? pfxprintk+0x10/0x10 ? printk+0xd5/0x120 ? virtaddrvalid+0x183/0x530 ? virtaddrvalid+0x183/0x530 printreport+0x169/0x550 ? virtaddrvalid+0x183/0x530 ? virtaddrvalid+0x183/0x530 ? virtaddrvalid+0x45f/0x530 ? physaddr+0xba/0x170 ? strlen+0x58/0x70 kasanreport+0x143/0x180 ? strlen+0x58/0x70 strlen+0x58/0x70 kstrdup+0x20/0x80 ledtgcheck+0x18b/0x3c0 xtchecktarget+0x3bb/0xa40 ? pfxxtchecktarget+0x10/0x10 ? stackdepotsaveflags+0x6e4/0x830 ? nfttargetinit+0x174/0xc30 nfttargetinit+0x82d/0xc30 ? pfxnfttargetinit+0x10/0x10 ? nftablesnewrule+0x1609/0x2980 ? nftablesnewrule+0x1609/0x2980 ? rcuiswatching+0x15/0xb0 ? nftablesnewrule+0x1609/0x2980 ? nftablesnewrule+0x1609/0x2980 ? kmallocnoprof+0x21a/0x400 nftablesnewrule+0x1860/0x2980 ? pfxnftablesnewrule+0x10/0x10 ? nlaparse+0x40/0x60 nfnetlinkrcv+0x14e5/0x2ab0 ? pfxvalidatechain+0x10/0x10 ? pfxnfnetlinkrcv+0x10/0x10 ? lockacquire+0x1384/0x2050 ? netlinkdelivertap+0x2e/0x1b0 ? pfxlockrelease+0x10/0x10 ? netlinkdelivertap+0x2e/0x1b0 netlinkunicast+0x7f8/0x990 ? pfxnetlinkunicast+0x10/0x10 ? virtaddrvalid+0x183/0x530 ? checkobjectsize+0x48e/0x900 netlinksendmsg+0x8e4/0xcb0 ? pfxnetlinksendmsg+0x10/0x10 ? aasockmsgperm+0x91/0x160 ? pfxnetlinksendmsg+0x10/0x10 socksendmsg+0x223/0x270 syssendmsg+0x52a/0x7e0 ? pfxsyssendmsg+0x10/0x10 syssendmsg+0x292/0x380 ? pfxsyssendmsg+0x10/0x10 ? lockdephardirqsonprepare+0x43d/0x780 ? pfxlockdephardirqsonprepare+0x10/0x10 ? excpagefault+0x590/0x8c0 ? dosyscall64+0xb6/0x230 dosyscall64+0xf3/0x230 entrySYSCALL64afterhwframe+0x77/0x7f ... </TASK>
Since an invalid (without '\0' byte at all) byte sequence may be passed from userspace, add an extra check to ensure that such a sequence is rejected as possible ID and so never passed to 'kstrdup()' and further.
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.27-1 - Upgrade
Upgrade
debian/linux-6.1to a version that resolves this vulnerability.Fixed in 6.1.129-1~deb11u1 - Configuration
In led_tg_check(), add an extra validation step to detect LED ID byte sequences from userspace that do not contain any '\0' terminator, and reject them before calling kstrdup().
netfilter x_tables (led_tg_check) LED ID check input validation = Reject invalid LED ID byte sequences that contain no '\0' byte; add an extra check so such sequences are rejected and never passed to 'kstrdup()' (and further).
Event History
Frequently Asked Questions
What is the severity of CVE-2024-56650?
CVE-2024-56650 has a high severity rating due to its potential impact on the Linux kernel.
How do I fix CVE-2024-56650?
To fix CVE-2024-56650, upgrade your Linux kernel to a version that contains the patch released for this vulnerability.
Which versions of the Linux kernel are affected by CVE-2024-56650?
CVE-2024-56650 affects multiple versions of the Linux kernel between 2.6.30 and 6.6.66, as well as the specific 6.13-rc1 release.
What type of vulnerability is CVE-2024-56650?
CVE-2024-56650 is a memory management vulnerability related to slab-out-of-bounds access in the Linux kernel.
What systems are at risk from CVE-2024-56650?
Systems running affected versions of the Linux kernel are at risk from CVE-2024-56650 and should be updated promptly.