dccp: fix dccp_v4_err()/dccp_v6_err() again (CVE-2023-52577)

Summary

dccp: fix dccp_v4_err()/dccp_v6_err() again

Original description

The description as published by the source.

In the Linux kernel, the following vulnerability has been resolved:

dccp: fix dccp_v4_err()/dccp_v6_err() again

dh->dccph_x is the 9th byte (offset 8) in "struct dccp_hdr",
not in the "byte 7" as Jann claimed.

We need to make sure the ICMP messages are big enough,
using more standard ways (no more assumptions).

syzbot reported:
BUG: KMSAN: uninit-value in pskb_may_pull_reason include/linux/skbuff.h:2667 [inline]
BUG: KMSAN: uninit-value in pskb_may_pull include/linux/skbuff.h:2681 [inline]
BUG: KMSAN: uninit-value in dccp_v6_err+0x426/0x1aa0 net/dccp/ipv6.c:94
pskb_may_pull_reason include/linux/skbuff.h:2667 [inline]
pskb_may_pull include/linux/skbuff.h:2681 [inline]
dccp_v6_err+0x426/0x1aa0 net/dccp/ipv6.c:94
icmpv6_notify+0x4c7/0x880 net/ipv6/icmp.c:867
icmpv6_rcv+0x19d5/0x30d0
ip6_protocol_deliver_rcu+0xda6/0x2a60 net/ipv6/ip6_input.c:438
ip6_input_finish net/ipv6/ip6_input.c:483 [inline]
NF_HOOK include/linux/netfilter.h:304 [inline]
ip6_input+0x15d/0x430 net/ipv6/ip6_input.c:492
ip6_mc_input+0xa7e/0xc80 net/ipv6/ip6_input.c:586
dst_input include/net/dst.h:468 [inline]
ip6_rcv_finish+0x5db/0x870 net/ipv6/ip6_input.c:79
NF_HOOK include/linux/netfilter.h:304 [inline]
ipv6_rcv+0xda/0x390 net/ipv6/ip6_input.c:310
__netif_receive_skb_one_core net/core/dev.c:5523 [inline]
__netif_receive_skb+0x1a6/0x5a0 net/core/dev.c:5637
netif_receive_skb_internal net/core/dev.c:5723 [inline]
netif_receive_skb+0x58/0x660 net/core/dev.c:5782
tun_rx_batched+0x83b/0x920
tun_get_user+0x564c/0…

Source: OSV.dev (Open Source Vulnerabilities) NVD OSV

Affected packages

Linux Kernel

[{"type":"ECOSYSTEM","events":[{"introduced":"4.14.326"},{"fixed":"4.14.327"}]},{"type":"ECOSYSTEM","events":[{"introduced":"4.19.295"},{"fixed":"4.19.296"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.4.257"},{"fixed":"5.4.258"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.10.195"},{"fixed":"5.10.198"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.15.132"},{"fixed":"5.15.134"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.1.53"},{"fixed":"6.1.56"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.5.3"},{"fixed":"6.5.6"}]}]

Fix status by distribution

Fixed packages published by each distribution for this CVE

Debian DEBIAN-CVE-2023-52577 linux Fixed in: 5.10.205-1

Summary

Original description

Affected packages

Fix status by distribution

References