CVE-2022-48687

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ipv6: sr: fix out-of-bounds read when setting HMAC data.<br /> <br /> The SRv6 layer allows defining HMAC data that can later be used to sign IPv6<br /> Segment Routing Headers. This configuration is realised via netlink through<br /> four attributes: SEG6_ATTR_HMACKEYID, SEG6_ATTR_SECRET, SEG6_ATTR_SECRETLEN and<br /> SEG6_ATTR_ALGID. Because the SECRETLEN attribute is decoupled from the actual<br /> length of the SECRET attribute, it is possible to provide invalid combinations<br /> (e.g., secret = "", secretlen = 64). This case is not checked in the code and<br /> with an appropriately crafted netlink message, an out-of-bounds read of up<br /> to 64 bytes (max secret length) can occur past the skb end pointer and into<br /> skb_shared_info:<br /> <br /> Breakpoint 1, seg6_genl_sethmac (skb=, info=) at net/ipv6/seg6.c:208<br /> 208 memcpy(hinfo-&gt;secret, secret, slen);<br /> (gdb) bt<br /> #0 seg6_genl_sethmac (skb=, info=) at net/ipv6/seg6.c:208<br /> #1 0xffffffff81e012e9 in genl_family_rcv_msg_doit (skb=skb@entry=0xffff88800b1f9f00, nlh=nlh@entry=0xffff88800b1b7600,<br /> extack=extack@entry=0xffffc90000ba7af0, ops=ops@entry=0xffffc90000ba7a80, hdrlen=4, net=0xffffffff84237580 , family=,<br /> family=) at net/netlink/genetlink.c:731<br /> #2 0xffffffff81e01435 in genl_family_rcv_msg (extack=0xffffc90000ba7af0, nlh=0xffff88800b1b7600, skb=0xffff88800b1f9f00,<br /> family=0xffffffff82fef6c0 ) at net/netlink/genetlink.c:775<br /> #3 genl_rcv_msg (skb=0xffff88800b1f9f00, nlh=0xffff88800b1b7600, extack=0xffffc90000ba7af0) at net/netlink/genetlink.c:792<br /> #4 0xffffffff81dfffc3 in netlink_rcv_skb (skb=skb@entry=0xffff88800b1f9f00, cb=cb@entry=0xffffffff81e01350 )<br /> at net/netlink/af_netlink.c:2501<br /> #5 0xffffffff81e00919 in genl_rcv (skb=0xffff88800b1f9f00) at net/netlink/genetlink.c:803<br /> #6 0xffffffff81dff6ae in netlink_unicast_kernel (ssk=0xffff888010eec800, skb=0xffff88800b1f9f00, sk=0xffff888004aed000)<br /> at net/netlink/af_netlink.c:1319<br /> #7 netlink_unicast (ssk=ssk@entry=0xffff888010eec800, skb=skb@entry=0xffff88800b1f9f00, portid=portid@entry=0, nonblock=)<br /> at net/netlink/af_netlink.c:1345<br /> #8 0xffffffff81dff9a4 in netlink_sendmsg (sock=, msg=0xffffc90000ba7e48, len=) at net/netlink/af_netlink.c:1921<br /> ...<br /> (gdb) p/x ((struct sk_buff *)0xffff88800b1f9f00)-&gt;head + ((struct sk_buff *)0xffff88800b1f9f00)-&gt;end<br /> $1 = 0xffff88800b1b76c0<br /> (gdb) p/x secret<br /> $2 = 0xffff88800b1b76c0<br /> (gdb) p slen<br /> $3 = 64 &amp;#39;@&amp;#39;<br /> <br /> The OOB data can then be read back from userspace by dumping HMAC state. This<br /> commit fixes this by ensuring SECRETLEN cannot exceed the actual length of<br /> SECRET.