Executive brief
A vulnerability was found in the Linux kernel's networking component that handles high-performance data transfer. A local user could potentially trigger an illegal memory access, which might lead to system instability or unauthorized access to sensitive information. This issue has been addressed by improving how the system validates user-provided data during network configuration.
Technical details
An out-of-bounds write vulnerability (CWE-787) exists in net/xdp/xsk.c within the Linux kernel. The function xsk_setsockopt() fails to properly validate the @optlen parameter when handling XDP_UMEM_FILL_RING or XDP_COMPLETION_FILL_RING options. This lack of validation allows a local attacker to trigger an illegal memory copy via copy_from_sockptr(), leading to a slab-out-of-bounds access as reported by syzbot. The vulnerability is reachable via the setsockopt() system call. Patches have been released across multiple stable kernel branches to enforce strict length validation.
Affected products
- Linux Linux Kernel 6.8.0-syzkaller-08951-gfe46a7dd189e and earlier versions
Timeline
- 2024-04-04: patched: Initial patch authored by Eric Dumazet
- 2024-05-20: disclosed: CVE published to NVD
References
- https://git.kernel.org/stable/c/0b45c25d60e38f5c2cb6823f886773a34323306d
- https://git.kernel.org/stable/c/237f3cf13b20db183d3706d997eedc3c49eacd44
- https://git.kernel.org/stable/c/2a523f14a3f53b46ff0e1fafd215b0bc5f6783aa
- https://git.kernel.org/stable/c/2eb979fbb2479bcd7e049f2f9978b6590dd8a0e6
- https://git.kernel.org/stable/c/a82984b3c6a7e8c7937dba6e857ddf829d149417
- https://git.kernel.org/stable/c/b143e19dc28c3211f050f7848d87d9b0a170e10c
- https://git.kernel.org/stable/c/beb99266830520e15fbc6ca8cc5a5240d76851fd