CVE-2024-26638

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

nbd: always initialize struct msghdr completely

syzbot complains that msg->msg_get_inq value can be uninitialized [1]

struct msghdr got many new fields recently, we should always make

sure their values is zero by default.

[1]

BUG: KMSAN: uninit-value in tcp_recvmsg+0x686/0xac0 net/ipv4/tcp.c:2571

tcp_recvmsg+0x686/0xac0 net/ipv4/tcp.c:2571

inet_recvmsg+0x131/0x580 net/ipv4/af_inet.c:879

sock_recvmsg_nosec net/socket.c:1044 [inline]

sock_recvmsg+0x12b/0x1e0 net/socket.c:1066

__sock_xmit+0x236/0x5c0 drivers/block/nbd.c:538

nbd_read_reply drivers/block/nbd.c:732 [inline]

recv_work+0x262/0x3100 drivers/block/nbd.c:863

process_one_work kernel/workqueue.c:2627 [inline]

process_scheduled_works+0x104e/0x1e70 kernel/workqueue.c:2700

worker_thread+0xf45/0x1490 kernel/workqueue.c:2781

kthread+0x3ed/0x540 kernel/kthread.c:388

ret_from_fork+0x66/0x80 arch/x86/kernel/process.c:147

ret_from_fork_asm+0x1

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References