CVE-2024-46783

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

tcp_bpf: fix return value of tcp_bpf_sendmsg()

When we cork messages in psock->cork, the last message triggers the

flushing will result in sending a sk_msg larger than the current

message size. In this case, in tcp_bpf_send_verdict(), 'copied' becomes

negative at least in the following case:

468 case __SK_DROP:

469 default:

470 sk_msg_free_partial(sk, msg, tosend);

471 sk_msg_apply_bytes(psock, tosend);

472 *copied -= (tosend + delta); // <==== HERE

473 return -EACCES;

Therefore, it could lead to the following BUG with a proper value of

'copied' (thanks to syzbot). We should not use negative 'copied' as a

return value here.

------------[ cut here ]------------

kernel BUG at net/socket.c:733!

Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP

Modules linked in:

CPU: 0 UID: 0 PID: 3265 Comm: syz-executor510 Not taint

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References