cbcvebase.
CVE-2024-35893
published 2024-05-19

CVE-2024-35893: In the Linux kernel, the following vulnerability has been resolved: net/sched: act_skbmod: prevent kernel-infoleak syzbot found that tcf_skbmod_dump() was…

PriorityP421medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.23%
14.2th percentile
In the Linux kernel, the following vulnerability has been resolved: net/sched: act_skbmod: prevent kernel-infoleak syzbot found that tcf_skbmod_dump() was copying four bytes from kernel stack to user space [1]. The issue here is that 'struct tc_skbmod' has a four bytes hole. We need to clear the structure before filling fields. [1] BUG: KMSAN: kernel-infoleak in instrument_copy_to_user include/linux/instrumented.h:114 [inline] BUG: KMSAN: kernel-infoleak in copy_to_user_iter lib/iov_iter.c:24 [inline] BUG: KMSAN: kernel-infoleak in iterate_ubuf include/linux/iov_iter.h:29 [inline] BUG: KMSAN: kernel-infoleak in iterate_and_advance2 include/linux/iov_iter.h:245 [inline] BUG: KMSAN: kernel-infoleak in iterate_and_advance include/linux/iov_iter.h:271 [inline] BUG: KMSAN: kernel-infoleak in _copy_to_iter+0x366/0x2520 lib/iov_iter.c:185 instrument_copy_to_user include/linux/instrumented.h:114 [inline] copy_to_user_iter lib/iov_iter.c:24 [inline] iterate_ubuf include/linux/iov_iter.h:29 [inline] iterate_and_advance2 include/linux/iov_iter.h:245 [inline] iterate_and_advance include/linux/iov_iter.h:271 [inline] _copy_to_iter+0x366/0x2520 lib/iov_iter.c:185 copy_to_iter include/linux/uio.h:196 [inline] simple_copy_to_iter net/core/datagram.c:532 [inline] __skb_datagram_iter+0x185/0x1000 net/core/datagram.c:420 skb_copy_datagram_iter+0x5c/0x200 net/core/datagram.c:546 skb_copy_datagram_msg include/linux/skbuff.h:4050 [inline] netlink_recvmsg+0x432/0x1610 net/netlink/af_netlink.c:1962 sock_recvmsg_nosec net/socket.c:1046 [inline] sock_recvmsg+0x2c4/0x340 net/socket.c:1068 __sys_recvfrom+0x35a/0x5f0 net/socket.c:2242 __do_sys_recvfrom net/socket.c:2260 [inline] __se_sys_recvfrom net/socket.c:2256 [inline] __x64_sys_recvfrom+0x126/0x1d0 net/socket.c:2256 do_syscall_64+0xd5/0x1f0 entry_SYSCALL_64_after_hwframe+0x6d/0x75 Uninit was stored to memory at: pskb_expand_head+0x30f/0x19d0 net/core/skbuff.c:2253 netlink_trim+0x2c2/0x330 net/netlink/af_netlink.c:1317 netlink_unicast

Affected

26 ranges· showing 25
VendorProductVersion rangeFixed in
debiandebian_linux
debianlinux< linux 6.1.85-1 (bookworm)linux 6.1.85-1 (bookworm)
linuxlinux
linuxlinux>= 86da71b57383d40993cb90baafb3735cffe5d800 < f190a4aa03cbd518bd9c62a66e1233984f5fd2ecf190a4aa03cbd518bd9c62a66e1233984f5fd2ec
linuxlinux>= 86da71b57383d40993cb90baafb3735cffe5d800 < f356eb2fb567e0931143ac1769ac802d3b3e2077f356eb2fb567e0931143ac1769ac802d3b3e2077
linuxlinux>= 86da71b57383d40993cb90baafb3735cffe5d800 < 5e45dc4408857305f4685abfd7a528a1e58b51b55e45dc4408857305f4685abfd7a528a1e58b51b5
linuxlinux>= 86da71b57383d40993cb90baafb3735cffe5d800 < a097fc199ab5f4b5392c5144034c0d2148b55a14a097fc199ab5f4b5392c5144034c0d2148b55a14
linuxlinux>= 86da71b57383d40993cb90baafb3735cffe5d800 < 55d3fe7b2b7bc354e7cbc1f7b8f98a29ccd5a36655d3fe7b2b7bc354e7cbc1f7b8f98a29ccd5a366
linuxlinux>= 86da71b57383d40993cb90baafb3735cffe5d800 < 729ad2ac2a2cdc9f4a4bdfd40bfd276e6bc33924729ad2ac2a2cdc9f4a4bdfd40bfd276e6bc33924
linuxlinux>= 86da71b57383d40993cb90baafb3735cffe5d800 < 7bb2c7103d8c13b06a57bf997b8cdbe93cd7283c7bb2c7103d8c13b06a57bf997b8cdbe93cd7283c
linuxlinux>= 86da71b57383d40993cb90baafb3735cffe5d800 < d313eb8b77557a6d5855f42d2234bd592c7b50ddd313eb8b77557a6d5855f42d2234bd592c7b50dd
linuxlinux_kernel
linuxlinux_kernel>= 0 < 5.10.216-15.10.216-1
linuxlinux_kernel>= 0 < 6.1.85-16.1.85-1
linuxlinux_kernel>= 0 < 6.8.9-16.8.9-1
linuxlinux_kernel>= 0 < 6.8.9-16.8.9-1
linuxlinux_kernel>= 0 < 5.4.0-189.2095.4.0-189.209
linuxlinux_kernel>= 0 < 5.15.0-116.1265.15.0-116.126
linuxlinux_kernel>= 0 < 6.8.0-38.386.8.0-38.38
linuxlinux_kernel>= 4.20 < 5.4.2745.4.274
linuxlinux_kernel>= 4.9 < 4.19.3124.19.312
linuxlinux_kernel>= 5.11 < 5.15.1545.15.154
linuxlinux_kernel>= 5.16 < 6.1.856.1.85
linuxlinux_kernel>= 5.5 < 5.10.2155.10.215
linuxlinux_kernel>= 6.2 < 6.6.266.6.26

CVSS provenance

nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv7.0HIGH
vendor_ubuntu7.0HIGH
vendor_debian5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.