In the Linux kernel, the following vulnerability has been resolved:
arp: Prevent overflow in arp_req_get().
syzkaller reported an overflown write in arp_req_get(). [0]
When ioctl(SIOCGARP) is issued, arp_req_get() looks up an neighbour
entry and copies neigh->ha to struct arpreq.arp_ha.sa_data.
The arp_ha here is struct sockaddr, not struct sockaddr_storage, so
the sa_data buffer is just 14 bytes.
In the splat below, 2 bytes are overflown to the next int field,
arp_flags. We initialise the field just after the memcpy(), so it's
not a problem.
However, when dev->addr_len is greater than 22 (e.g. MAX_ADDR_LEN),
arp_netmask is overwritten, which could be set as htonl(0xFFFFFFFFUL)
in arp_ioctl() before calling arp_req_get().
To avoid the overflow, let's limit the max length of memcpy().
Note that commit b5f0de6df6dc ("net: dev: Convert sa_data to flexible
array in struct sockaddr") just silenced syzkaller.
[0]:
memcpy: detected field-spanning write (size 16) of single field "r->arp_ha.sa_data" at net/ipv4/arp.c:1128 (size 14)
WARNING: CPU: 0 PID: 144638 at net/ipv4/arp.c:1128 arp_req_get+0x411/0x4a0 net/ipv4/arp.c:1128
Modules linked in:
CPU: 0 PID: 144638 Comm: syz-executor.4 Not tainted 6.1.74 #31
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.0-debian-1.16.0-5 04/01/2014
RIP: 0010:arp_req_get+0x411/0x4a0 net/ipv4/arp.c:1128
Code: fd ff ff e8 41 42 de fb b9 0e 00 00 00 4c 89 fe 48 c7 c2 20 6d ab 87 48 c7 c7 80 6d ab 87 c6 05 25 af 72 04 01 e8 5f 8d ad fb <0f> 0b e9 6c fd ff ff e8 13 42 de fb be 03 00 00 00 4c 89 e7 e8 a6
RSP: 0018:ffffc900050b7998 EFLAGS: 00010286
RAX: 0000000000000000 RBX: ffff88803a815000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff8641a44a RDI: 0000000000000001
RBP: ffffc900050b7a98 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 203a7970636d656d R12: ffff888039c54000
R13: 1ffff92000a16f37 R14: ffff88803a815084 R15: 0000000000000010
FS: 00007f172bf306c0(0000) GS:ffff88805aa00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f172b3569f0 CR3: 0000000057f12005 CR4: 0000000000770ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
PKRU: 55555554
Call Trace:
<TASK>
arp_ioctl+0x33f/0x4b0 net/ipv4/arp.c:1261
inet_ioctl+0x314/0x3a0 net/ipv4/af_inet.c:981
sock_do_ioctl+0xdf/0x260 net/socket.c:1204
sock_ioctl+0x3ef/0x650 net/socket.c:1321
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:870 [inline]
__se_sys_ioctl fs/ioctl.c:856 [inline]
__x64_sys_ioctl+0x18e/0x220 fs/ioctl.c:856
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x37/0x90 arch/x86/entry/common.c:81
entry_SYSCALL_64_after_hwframe+0x64/0xce
RIP: 0033:0x7f172b262b8d
Code: 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f172bf300b8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f172b3abf80 RCX: 00007f172b262b8d
RDX: 0000000020000000 RSI: 0000000000008954 RDI: 0000000000000003
RBP: 00007f172b2d3493 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 000000000000000b R14: 00007f172b3abf80 R15: 00007f172bf10000
</TASK>
References
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Configuration 3 (hide)
| AND |
|
Configuration 4 (hide)
| AND |
|
Configuration 5 (hide)
| AND |
|
Configuration 6 (hide)
| AND |
|
Configuration 7 (hide)
| AND |
|
Configuration 8 (hide)
| AND |
|
Configuration 9 (hide)
| AND |
|
Configuration 10 (hide)
| AND |
|
Configuration 11 (hide)
| AND |
|
Configuration 12 (hide)
| AND |
|
Configuration 13 (hide)
| AND |
|
Configuration 14 (hide)
| AND |
|
Configuration 15 (hide)
| AND |
|
Configuration 16 (hide)
| AND |
|
Configuration 17 (hide)
| AND |
|
Configuration 18 (hide)
| AND |
|
Configuration 19 (hide)
| AND |
|
Configuration 20 (hide)
| AND |
|
Configuration 21 (hide)
| AND |
|
Configuration 22 (hide)
| AND |
|
Configuration 23 (hide)
| AND |
|
Configuration 24 (hide)
| AND |
|
Configuration 25 (hide)
| AND |
|
Configuration 26 (hide)
| AND |
|
Configuration 27 (hide)
| AND |
|
Configuration 28 (hide)
| AND |
|
Configuration 29 (hide)
|
History
17 Mar 2025, 16:02
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Netapp 8300 Firmware
Netapp 9500 Netapp h615c Netapp c400 Netapp a400 Netapp Netapp a90 Netapp h610s Netapp a300 Firmware Netapp 9000 Netapp a700 Linux Netapp 8300 Netapp a320 Firmware Netapp a320 Netapp a400 Firmware Netapp a70 Firmware Netapp a220 Firmware Netapp fas2720 Firmware Netapp c400 Firmware Netapp c800 Netapp fas2750 Firmware Netapp fas2750 Netapp h610c Netapp a900 Debian debian Linux Netapp c190 Netapp h610c Firmware Netapp a800 Firmware Netapp c190 Firmware Linux linux Kernel Netapp a800 Netapp a900 Firmware Netapp a700s Netapp 8700 Netapp 9000 Firmware Netapp 8700 Firmware Netapp fas2820 Netapp 8200 Netapp h610s Firmware Netapp h615c Firmware Netapp a700s Firmware Netapp e-series Santricity Os Controller Netapp a220 Netapp fas2720 Debian Netapp a300 Netapp a150 Firmware Netapp c800 Firmware Netapp 8200 Firmware Netapp a1k Netapp a700 Firmware Netapp a90 Firmware Netapp a1k Firmware Netapp a150 Netapp a70 Netapp fas2820 Firmware Netapp 9500 Firmware |
|
| CWE | CWE-787 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.5 |
| References | () https://git.kernel.org/stable/c/3ab0d6f8289ba8402ca95a9fc61a34909d5e1f3a - Patch | |
| References | () https://git.kernel.org/stable/c/97eaa2955db4120ce6ec2ef123e860bc32232c50 - Patch | |
| References | () https://git.kernel.org/stable/c/a3f2c083cb575d80a7627baf3339e78fedccbb91 - Patch | |
| References | () https://git.kernel.org/stable/c/a7d6027790acea24446ddd6632d394096c0f4667 - Patch | |
| References | () https://git.kernel.org/stable/c/dbc9b22d0ed319b4e29034ce0a3fe32a3ee2c587 - Patch | |
| References | () https://git.kernel.org/stable/c/f119f2325ba70cbfdec701000dcad4d88805d5b0 - Patch | |
| References | () https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html - Mailing List | |
| References | () https://security.netapp.com/advisory/ntap-20241101-0013/ - Third Party Advisory | |
| CPE | cpe:2.3:o:linux:linux_kernel:6.8:rc2:*:*:*:*:*:* cpe:2.3:h:netapp:8700:*:*:*:*:*:*:*:* cpe:2.3:h:netapp:a150:*:*:*:*:*:*:*:* cpe:2.3:h:netapp:a70:*:*:*:*:*:*:*:* cpe:2.3:h:netapp:c190:*:*:*:*:*:*:*:* cpe:2.3:h:netapp:c400:*:*:*:*:*:*:*:* cpe:2.3:o:netapp:a700s_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:netapp:a300_firmware:-:*:*:*:*:*:*:* cpe:2.3:h:netapp:a320:*:*:*:*:*:*:*:* cpe:2.3:o:netapp:c800_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:netapp:a1k_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:netapp:fas2720_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:netapp:8200_firmware:-:*:*:*:*:*:*:* cpe:2.3:h:netapp:a220:*:*:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:5.10.211:*:*:*:*:*:*:* cpe:2.3:a:netapp:e-series_santricity_os_controller:*:*:*:*:*:*:*:* cpe:2.3:o:netapp:fas2750_firmware:-:*:*:*:*:*:*:* cpe:2.3:h:netapp:a1k:*:*:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.8:rc5:*:*:*:*:*:* cpe:2.3:o:netapp:a900_firmware:-:*:*:*:*:*:*:* cpe:2.3:h:netapp:9000:*:*:*:*:*:*:*:* cpe:2.3:h:netapp:a700:*:*:*:*:*:*:*:* cpe:2.3:h:netapp:h610c:*:*:*:*:*:*:*:* cpe:2.3:h:netapp:a300:*:*:*:*:*:*:*:* cpe:2.3:o:netapp:9500_firmware:-:*:*:*:*:*:*:* cpe:2.3:h:netapp:8200:*:*:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.8:rc4:*:*:*:*:*:* cpe:2.3:o:netapp:a400_firmware:-:*:*:*:*:*:*:* cpe:2.3:h:netapp:9500:*:*:*:*:*:*:*:* cpe:2.3:o:netapp:fas2820_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* cpe:2.3:h:netapp:h610s:*:*:*:*:*:*:*:* cpe:2.3:o:netapp:a800_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:netapp:a700_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:netapp:a320_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.8:rc1:*:*:*:*:*:* cpe:2.3:h:netapp:a800:*:*:*:*:*:*:*:* cpe:2.3:o:netapp:c190_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:netapp:a150_firmware:-:*:*:*:*:*:*:* cpe:2.3:h:netapp:c800:*:*:*:*:*:*:*:* cpe:2.3:o:netapp:a220_firmware:-:*:*:*:*:*:*:* cpe:2.3:h:netapp:fas2720:*:*:*:*:*:*:*:* cpe:2.3:h:netapp:a900:*:*:*:*:*:*:*:* cpe:2.3:o:netapp:a90_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:netapp:h610s_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:netapp:c400_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:netapp:h615c_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:netapp:8700_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:netapp:h610c_firmware:-:*:*:*:*:*:*:* cpe:2.3:h:netapp:a400:*:*:*:*:*:*:*:* cpe:2.3:h:netapp:fas2820:*:*:*:*:*:*:*:* cpe:2.3:h:netapp:a700s:*:*:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.8:rc3:*:*:*:*:*:* cpe:2.3:h:netapp:h615c:*:*:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* cpe:2.3:o:netapp:a70_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:netapp:8300_firmware:-:*:*:*:*:*:*:* cpe:2.3:h:netapp:fas2750:*:*:*:*:*:*:*:* cpe:2.3:o:netapp:9000_firmware:-:*:*:*:*:*:*:* cpe:2.3:h:netapp:a90:*:*:*:*:*:*:*:* cpe:2.3:h:netapp:8300:*:*:*:*:*:*:*:* |
Information
Published : 2024-04-03 17:15
Updated : 2025-03-17 16:02
NVD link : CVE-2024-26733
Mitre link : CVE-2024-26733
CVE.ORG link : CVE-2024-26733
JSON object : View
Products Affected
netapp
- c800_firmware
- a90
- 8700_firmware
- h610s
- a700s
- c400_firmware
- fas2720_firmware
- fas2750
- 8200
- a700_firmware
- h610c
- h615c
- a90_firmware
- a400
- a300
- a1k
- 9500_firmware
- a150
- fas2720
- fas2820
- 8200_firmware
- a320
- fas2820_firmware
- a700
- a900
- a900_firmware
- a800
- a400_firmware
- c190_firmware
- c800
- c190
- h615c_firmware
- a70_firmware
- 9000
- a1k_firmware
- a800_firmware
- a220
- 8700
- h610s_firmware
- a300_firmware
- a320_firmware
- a700s_firmware
- a70
- 8300_firmware
- c400
- a150_firmware
- a220_firmware
- fas2750_firmware
- h610c_firmware
- 9500
- e-series_santricity_os_controller
- 8300
- 9000_firmware
linux
- linux_kernel
debian
- debian_linux
CWE
CWE-787
Out-of-bounds Write