CVE-2024-35944

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> VMCI: Fix memcpy() run-time warning in dg_dispatch_as_host()<br /> <br /> Syzkaller hit &amp;#39;WARNING in dg_dispatch_as_host&amp;#39; bug.<br /> <br /> memcpy: detected field-spanning write (size 56) of single field "&amp;dg_info-&gt;msg"<br /> at drivers/misc/vmw_vmci/vmci_datagram.c:237 (size 24)<br /> <br /> WARNING: CPU: 0 PID: 1555 at drivers/misc/vmw_vmci/vmci_datagram.c:237<br /> dg_dispatch_as_host+0x88e/0xa60 drivers/misc/vmw_vmci/vmci_datagram.c:237<br /> <br /> Some code commentry, based on my understanding:<br /> <br /> 544 #define VMCI_DG_SIZE(_dg) (VMCI_DG_HEADERSIZE + (size_t)(_dg)-&gt;payload_size)<br /> /// This is 24 + payload_size<br /> <br /> memcpy(&amp;dg_info-&gt;msg, dg, dg_size);<br /> Destination = dg_info-&gt;msg ---&gt; this is a 24 byte<br /> structure(struct vmci_datagram)<br /> Source = dg --&gt; this is a 24 byte structure (struct vmci_datagram)<br /> Size = dg_size = 24 + payload_size<br /> <br /> {payload_size = 56-24 =32} -- Syzkaller managed to set payload_size to 32.<br /> <br /> 35 struct delayed_datagram_info {<br /> 36 struct datagram_entry *entry;<br /> 37 struct work_struct work;<br /> 38 bool in_dg_host_queue;<br /> 39 /* msg and msg_payload must be together. */<br /> 40 struct vmci_datagram msg;<br /> 41 u8 msg_payload[];<br /> 42 };<br /> <br /> So those extra bytes of payload are copied into msg_payload[], a run time<br /> warning is seen while fuzzing with Syzkaller.<br /> <br /> One possible way to fix the warning is to split the memcpy() into<br /> two parts -- one -- direct assignment of msg and second taking care of payload.<br /> <br /> Gustavo quoted:<br /> "Under FORTIFY_SOURCE we should not copy data across multiple members<br /> in a structure."