SUSE: CVE-2024-35944: SUSE Linux Security Advisory

SUSE: CVE-2024-35944: SUSE Linux Security Advisory

Severity

4

CVSS

(AV:L/AC:M/Au:N/C:P/I:P/A:P)

Published

05/19/2024

Created

06/13/2024

Added

06/12/2024

Modified

08/28/2024

Description

In the Linux kernel, the following vulnerability has been resolved: VMCI: Fix memcpy() run-time warning in dg_dispatch_as_host() Syzkaller hit 'WARNING in dg_dispatch_as_host' bug. memcpy: detected field-spanning write (size 56) of single field "&dg_info->msg" at drivers/misc/vmw_vmci/vmci_datagram.c:237 (size 24) WARNING: CPU: 0 PID: 1555 at drivers/misc/vmw_vmci/vmci_datagram.c:237 dg_dispatch_as_host+0x88e/0xa60 drivers/misc/vmw_vmci/vmci_datagram.c:237 Some code commentry, based on my understanding: 544 #define VMCI_DG_SIZE(_dg) (VMCI_DG_HEADERSIZE + (size_t)(_dg)->payload_size) /// This is 24 + payload_size memcpy(&dg_info->msg, dg, dg_size); Destination = dg_info->msg ---> this is a 24 byte structure(struct vmci_datagram) Source = dg --> this is a 24 byte structure (struct vmci_datagram) Size = dg_size = 24 + payload_size {payload_size = 56-24 =32} -- Syzkaller managed to set payload_size to 32. 35 struct delayed_datagram_info { 36 struct datagram_entry *entry; 37 struct work_struct work; 38 bool in_dg_host_queue; 39 /* msg and msg_payload must be together. */ 40 struct vmci_datagram msg; 41 u8 msg_payload[]; 42 }; So those extra bytes of payload are copied into msg_payload[], a run time warning is seen while fuzzing with Syzkaller. One possible way to fix the warning is to split the memcpy() into two parts -- one -- direct assignment of msg and second taking care of payload. Gustavo quoted: "Under FORTIFY_SOURCE we should not copy data across multiple members in a structure."

Solution(s)

• suse-upgrade-cluster-md-kmp-64kb
• suse-upgrade-cluster-md-kmp-azure
• suse-upgrade-cluster-md-kmp-default
• suse-upgrade-cluster-md-kmp-rt
• suse-upgrade-dlm-kmp-64kb
• suse-upgrade-dlm-kmp-azure
• suse-upgrade-dlm-kmp-default
• suse-upgrade-dlm-kmp-rt
• suse-upgrade-dtb-allwinner
• suse-upgrade-dtb-altera
• suse-upgrade-dtb-amazon
• suse-upgrade-dtb-amd
• suse-upgrade-dtb-amlogic
• suse-upgrade-dtb-apm
• suse-upgrade-dtb-apple
• suse-upgrade-dtb-arm
• suse-upgrade-dtb-broadcom
• suse-upgrade-dtb-cavium
• suse-upgrade-dtb-exynos
• suse-upgrade-dtb-freescale
• suse-upgrade-dtb-hisilicon
• suse-upgrade-dtb-lg
• suse-upgrade-dtb-marvell
• suse-upgrade-dtb-mediatek
• suse-upgrade-dtb-nvidia
• suse-upgrade-dtb-qcom
• suse-upgrade-dtb-renesas
• suse-upgrade-dtb-rockchip
• suse-upgrade-dtb-socionext
• suse-upgrade-dtb-sprd
• suse-upgrade-dtb-xilinx
• suse-upgrade-gfs2-kmp-64kb
• suse-upgrade-gfs2-kmp-azure
• suse-upgrade-gfs2-kmp-default
• suse-upgrade-gfs2-kmp-rt
• suse-upgrade-kernel-64kb
• suse-upgrade-kernel-64kb-devel
• suse-upgrade-kernel-64kb-extra
• suse-upgrade-kernel-64kb-livepatch-devel
• suse-upgrade-kernel-64kb-optional
• suse-upgrade-kernel-azure
• suse-upgrade-kernel-azure-base
• suse-upgrade-kernel-azure-devel
• suse-upgrade-kernel-azure-extra
• suse-upgrade-kernel-azure-livepatch-devel
• suse-upgrade-kernel-azure-optional
• suse-upgrade-kernel-azure-vdso
• suse-upgrade-kernel-debug
• suse-upgrade-kernel-debug-devel
• suse-upgrade-kernel-debug-livepatch-devel
• suse-upgrade-kernel-debug-vdso
• suse-upgrade-kernel-default
• suse-upgrade-kernel-default-base
• suse-upgrade-kernel-default-base-rebuild
• suse-upgrade-kernel-default-devel
• suse-upgrade-kernel-default-extra
• suse-upgrade-kernel-default-livepatch
• suse-upgrade-kernel-default-livepatch-devel
• suse-upgrade-kernel-default-man
• suse-upgrade-kernel-default-optional
• suse-upgrade-kernel-default-vdso
• suse-upgrade-kernel-devel
• suse-upgrade-kernel-devel-azure
• suse-upgrade-kernel-devel-rt
• suse-upgrade-kernel-docs
• suse-upgrade-kernel-docs-html
• suse-upgrade-kernel-kvmsmall
• suse-upgrade-kernel-kvmsmall-devel
• suse-upgrade-kernel-kvmsmall-livepatch-devel
• suse-upgrade-kernel-kvmsmall-vdso
• suse-upgrade-kernel-macros
• suse-upgrade-kernel-obs-build
• suse-upgrade-kernel-obs-qa
• suse-upgrade-kernel-rt
• suse-upgrade-kernel-rt-devel
• suse-upgrade-kernel-rt-extra
• suse-upgrade-kernel-rt-livepatch
• suse-upgrade-kernel-rt-livepatch-devel
• suse-upgrade-kernel-rt-optional
• suse-upgrade-kernel-rt-vdso
• suse-upgrade-kernel-rt_debug
• suse-upgrade-kernel-rt_debug-devel
• suse-upgrade-kernel-rt_debug-livepatch-devel
• suse-upgrade-kernel-rt_debug-vdso
• suse-upgrade-kernel-source
• suse-upgrade-kernel-source-azure
• suse-upgrade-kernel-source-rt
• suse-upgrade-kernel-source-vanilla
• suse-upgrade-kernel-syms
• suse-upgrade-kernel-syms-azure
• suse-upgrade-kernel-syms-rt
• suse-upgrade-kernel-zfcpdump
• suse-upgrade-kselftests-kmp-64kb
• suse-upgrade-kselftests-kmp-azure
• suse-upgrade-kselftests-kmp-default
• suse-upgrade-kselftests-kmp-rt
• suse-upgrade-ocfs2-kmp-64kb
• suse-upgrade-ocfs2-kmp-azure
• suse-upgrade-ocfs2-kmp-default
• suse-upgrade-ocfs2-kmp-rt
• suse-upgrade-reiserfs-kmp-64kb
• suse-upgrade-reiserfs-kmp-azure
• suse-upgrade-reiserfs-kmp-default
• suse-upgrade-reiserfs-kmp-rt

References

• https://attackerkb.com/topics/cve-2024-35944
• CVE - 2024-35944