{
  "threat_severity" : "Low",
  "public_date" : "2024-05-21T00:00:00Z",
  "bugzilla" : {
    "description" : "kernel: tipc: Change nla_policy for bearer-related names to NLA_NUL_STRING",
    "id" : "2282759",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2282759"
  },
  "cvss3" : {
    "cvss3_base_score" : "4.4",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
    "status" : "verified"
  },
  "cwe" : "CWE-476",
  "details" : [ "In the Linux kernel, the following vulnerability has been resolved:\ntipc: Change nla_policy for bearer-related names to NLA_NUL_STRING\nsyzbot reported the following uninit-value access issue [1]:\n=====================================================\nBUG: KMSAN: uninit-value in strlen lib/string.c:418 [inline]\nBUG: KMSAN: uninit-value in strstr+0xb8/0x2f0 lib/string.c:756\nstrlen lib/string.c:418 [inline]\nstrstr+0xb8/0x2f0 lib/string.c:756\ntipc_nl_node_reset_link_stats+0x3ea/0xb50 net/tipc/node.c:2595\ngenl_family_rcv_msg_doit net/netlink/genetlink.c:971 [inline]\ngenl_family_rcv_msg net/netlink/genetlink.c:1051 [inline]\ngenl_rcv_msg+0x11ec/0x1290 net/netlink/genetlink.c:1066\nnetlink_rcv_skb+0x371/0x650 net/netlink/af_netlink.c:2545\ngenl_rcv+0x40/0x60 net/netlink/genetlink.c:1075\nnetlink_unicast_kernel net/netlink/af_netlink.c:1342 [inline]\nnetlink_unicast+0xf47/0x1250 net/netlink/af_netlink.c:1368\nnetlink_sendmsg+0x1238/0x13d0 net/netlink/af_netlink.c:1910\nsock_sendmsg_nosec net/socket.c:730 [inline]\nsock_sendmsg net/socket.c:753 [inline]\n____sys_sendmsg+0x9c2/0xd60 net/socket.c:2541\n___sys_sendmsg+0x28d/0x3c0 net/socket.c:2595\n__sys_sendmsg net/socket.c:2624 [inline]\n__do_sys_sendmsg net/socket.c:2633 [inline]\n__se_sys_sendmsg net/socket.c:2631 [inline]\n__x64_sys_sendmsg+0x307/0x490 net/socket.c:2631\ndo_syscall_x64 arch/x86/entry/common.c:50 [inline]\ndo_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80\nentry_SYSCALL_64_after_hwframe+0x63/0xcd\nUninit was created at:\nslab_post_alloc_hook+0x12f/0xb70 mm/slab.h:767\nslab_alloc_node mm/slub.c:3478 [inline]\nkmem_cache_alloc_node+0x577/0xa80 mm/slub.c:3523\nkmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:559\n__alloc_skb+0x318/0x740 net/core/skbuff.c:650\nalloc_skb include/linux/skbuff.h:1286 [inline]\nnetlink_alloc_large_skb net/netlink/af_netlink.c:1214 [inline]\nnetlink_sendmsg+0xb34/0x13d0 net/netlink/af_netlink.c:1885\nsock_sendmsg_nosec net/socket.c:730 [inline]\nsock_sendmsg net/socket.c:753 [inline]\n____sys_sendmsg+0x9c2/0xd60 net/socket.c:2541\n___sys_sendmsg+0x28d/0x3c0 net/socket.c:2595\n__sys_sendmsg net/socket.c:2624 [inline]\n__do_sys_sendmsg net/socket.c:2633 [inline]\n__se_sys_sendmsg net/socket.c:2631 [inline]\n__x64_sys_sendmsg+0x307/0x490 net/socket.c:2631\ndo_syscall_x64 arch/x86/entry/common.c:50 [inline]\ndo_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80\nentry_SYSCALL_64_after_hwframe+0x63/0xcd\nTIPC bearer-related names including link names must be null-terminated\nstrings. If a link name which is not null-terminated is passed through\nnetlink, strstr() and similar functions can cause buffer overrun. This\ncauses the above issue.\nThis patch changes the nla_policy for bearer-related names from NLA_STRING\nto NLA_NUL_STRING. This resolves the issue by ensuring that only\nnull-terminated strings are accepted as bearer-related names.\nsyzbot reported similar uninit-value issue related to bearer names [2]. The\nroot cause of this issue is that a non-null-terminated bearer name was\npassed. This patch also resolved this issue." ],
  "affected_release" : [ {
    "product_name" : "Red Hat Enterprise Linux 8",
    "release_date" : "2024-08-08T00:00:00Z",
    "advisory" : "RHSA-2024:5102",
    "cpe" : "cpe:/a:redhat:enterprise_linux:8::nfv",
    "package" : "kernel-rt-0:4.18.0-553.16.1.rt7.357.el8_10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "release_date" : "2024-08-08T00:00:00Z",
    "advisory" : "RHSA-2024:5101",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8",
    "package" : "kernel-0:4.18.0-553.16.1.el8_10"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Not affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Fix deferred",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Fix deferred",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2023-52845\nhttps://nvd.nist.gov/vuln/detail/CVE-2023-52845\nhttps://lore.kernel.org/linux-cve-announce/2024052112-CVE-2023-52845-0245@gregkh/T" ],
  "name" : "CVE-2023-52845",
  "csaw" : false
}