CVE-2024-26733

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

arp: Prevent overflow in arp_req_get().

syzkaller reported an overflown write in arp_req_get(). [0]

When ioctl(SIOCGARP) is issued, arp_req_get() looks up an neighbour

entry and copies neigh->ha to struct arpreq.arp_ha.sa_data.

The arp_ha here is struct sockaddr, not struct sockaddr_storage, so

the sa_data buffer is just 14 bytes.

In the splat below, 2 bytes are overflown to the next int field,

arp_flags. We initialise the field just after the memcpy(), so it's

not a problem.

However, when dev->addr_len is greater than 22 (e.g. MAX_ADDR_LEN),

arp_netmask is overwritten, which could be set as htonl(0xFFFFFFFFUL)

in arp_ioctl() before calling arp_req_get().

To avoid the overflow, let's limit the max length of memcpy().

Note that commit b5f0de6df6dc ("net: dev: Convert sa_data to flexible

array in struct sockaddr") just silenced syzkaller.

[0]:

memcpy: detected field-spanning write (size 16) of single field "r->

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References