Wind River Support Network

HomeDefectsLIN1023-4881

Fixed

LIN1023-4881 : Security Advisory - linux - CVE-2024-26849

Created: Apr 17, 2024 Updated: Apr 20, 2024

Resolved Date: Apr 19, 2024

Found In Version: 10.23.30.1

Severity: Standard

Applicable for: Wind River Linux LTS 23

Component/s: Kernel

Description

In the Linux kernel, the following vulnerability has been resolved:

netlink: add nla be16/32 types to minlen array

BUG: KMSAN: uninit-value in nla_validate_range_unsigned lib/nlattr.c:222 inline]
BUG: KMSAN: uninit-value in nla_validate_int_range lib/nlattr.c:336 [inline]
BUG: KMSAN: uninit-value in validate_nla lib/nlattr.c:575 [inline]
BUG: KMSAN: uninit-value in __nla_validate_parse+0x2e20/0x45c0 lib/nlattr.c:631
 nla_validate_range_unsigned lib/nlattr.c:222 [inline]
 nla_validate_int_range lib/nlattr.c:336 [inline]
 validate_nla lib/nlattr.c:575 [inline]
...

The message in question matches this policy:

 [NFTA_TARGET_REV]       = NLA_POLICY_MAX(NLA_BE32, 255),

but because NLA_BE32 size in minlen array is 0, the validation
code will read past the malformed (too small) attribute.

Note: Other attributes, e.g. BITFIELD32, SINT, UINT.. are also missing:
those likely should be added too.

CREATE(Triage):(User=admin) [CVE-2024-26849 (https://nvd.nist.gov/vuln/detail/CVE-2024-26849)

CVEs

CVE-2024-26849