ppp: fix ppp_async_encode() illegal access 漏洞信息(CVE-2024-50035)

一、漏洞 CVE-2024-50035 基础信息

漏洞标题

PPP协议ppp_async_encode()函数存在非法访问漏洞

来源：AIGC 神龙大模型

漏洞描述信息

N/A

来源：AIGC 神龙大模型

CVSS信息

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

来源：AIGC 神龙大模型

漏洞类别

跨界内存写

来源：AIGC 神龙大模型

漏洞标题

ppp: fix ppp_async_encode() illegal access

来源：美国国家漏洞数据库 NVD

漏洞描述信息

In the Linux kernel, the following vulnerability has been resolved: ppp: fix ppp_async_encode() illegal access syzbot reported an issue in ppp_async_encode() [1] In this case, pppoe_sendmsg() is called with a zero size. Then ppp_async_encode() is called with an empty skb. BUG: KMSAN: uninit-value in ppp_async_encode drivers/net/ppp/ppp_async.c:545 [inline] BUG: KMSAN: uninit-value in ppp_async_push+0xb4f/0x2660 drivers/net/ppp/ppp_async.c:675 ppp_async_encode drivers/net/ppp/ppp_async.c:545 [inline] ppp_async_push+0xb4f/0x2660 drivers/net/ppp/ppp_async.c:675 ppp_async_send+0x130/0x1b0 drivers/net/ppp/ppp_async.c:634 ppp_channel_bridge_input drivers/net/ppp/ppp_generic.c:2280 [inline] ppp_input+0x1f1/0xe60 drivers/net/ppp/ppp_generic.c:2304 pppoe_rcv_core+0x1d3/0x720 drivers/net/ppp/pppoe.c:379 sk_backlog_rcv+0x13b/0x420 include/net/sock.h:1113 __release_sock+0x1da/0x330 net/core/sock.c:3072 release_sock+0x6b/0x250 net/core/sock.c:3626 pppoe_sendmsg+0x2b8/0xb90 drivers/net/ppp/pppoe.c:903 sock_sendmsg_nosec net/socket.c:729 [inline] __sock_sendmsg+0x30f/0x380 net/socket.c:744 ____sys_sendmsg+0x903/0xb60 net/socket.c:2602 ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2656 __sys_sendmmsg+0x3c1/0x960 net/socket.c:2742 __do_sys_sendmmsg net/socket.c:2771 [inline] __se_sys_sendmmsg net/socket.c:2768 [inline] __x64_sys_sendmmsg+0xbc/0x120 net/socket.c:2768 x64_sys_call+0xb6e/0x3ba0 arch/x86/include/generated/asm/syscalls_64.h:308 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Uninit was created at: slab_post_alloc_hook mm/slub.c:4092 [inline] slab_alloc_node mm/slub.c:4135 [inline] kmem_cache_alloc_node_noprof+0x6bf/0xb80 mm/slub.c:4187 kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:587 __alloc_skb+0x363/0x7b0 net/core/skbuff.c:678 alloc_skb include/linux/skbuff.h:1322 [inline] sock_wmalloc+0xfe/0x1a0 net/core/sock.c:2732 pppoe_sendmsg+0x3a7/0xb90 drivers/net/ppp/pppoe.c:867 sock_sendmsg_nosec net/socket.c:729 [inline] __sock_sendmsg+0x30f/0x380 net/socket.c:744 ____sys_sendmsg+0x903/0xb60 net/socket.c:2602 ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2656 __sys_sendmmsg+0x3c1/0x960 net/socket.c:2742 __do_sys_sendmmsg net/socket.c:2771 [inline] __se_sys_sendmmsg net/socket.c:2768 [inline] __x64_sys_sendmmsg+0xbc/0x120 net/socket.c:2768 x64_sys_call+0xb6e/0x3ba0 arch/x86/include/generated/asm/syscalls_64.h:308 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f CPU: 1 UID: 0 PID: 5411 Comm: syz.1.14 Not tainted 6.12.0-rc1-syzkaller-00165-g360c1f1f24c6 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024

来源：美国国家漏洞数据库 NVD

CVSS信息

N/A

来源：美国国家漏洞数据库 NVD

漏洞类别

N/A

来源：美国国家漏洞数据库 NVD

漏洞标题

Linux kernel 安全漏洞

来源：中国国家信息安全漏洞库 CNNVD

漏洞描述信息

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于ppp组件在ppp_async_encode函数中的非法访问。

来源：中国国家信息安全漏洞库 CNNVD

CVSS信息

N/A

来源：中国国家信息安全漏洞库 CNNVD

漏洞类别

其他

来源：中国国家信息安全漏洞库 CNNVD

二、漏洞 CVE-2024-50035 的公开POC

#	POC 描述	源链接	神龙链接

三、漏洞 CVE-2024-50035 的情报信息

标题： ppp: fix ppp_async_encode() illegal access - kernel/git/stable/linux.git - Linux kernel stable tree -- 🔗来源链接

标签：
神龙速读
标题： ppp: fix ppp_async_encode() illegal access - kernel/git/stable/linux.git - Linux kernel stable tree -- 🔗来源链接

标签：
神龙速读
标题： ppp: fix ppp_async_encode() illegal access - kernel/git/stable/linux.git - Linux kernel stable tree -- 🔗来源链接

标签：
神龙速读
标题： ppp: fix ppp_async_encode() illegal access - kernel/git/stable/linux.git - Linux kernel stable tree -- 🔗来源链接

标签：
神龙速读
标题： ppp: fix ppp_async_encode() illegal access - kernel/git/stable/linux.git - Linux kernel stable tree -- 🔗来源链接

标签：
神龙速读
标题： ppp: fix ppp_async_encode() illegal access - kernel/git/stable/linux.git - Linux kernel stable tree -- 🔗来源链接

标签：
神龙速读
标题： ppp: fix ppp_async_encode() illegal access - kernel/git/stable/linux.git - Linux kernel stable tree -- 🔗来源链接

标签：
神龙速读
标题： ppp: fix ppp_async_encode() illegal access - kernel/git/stable/linux.git - Linux kernel stable tree -- 🔗来源链接

标签：
神龙速读
https://nvd.nist.gov/vuln/detail/CVE-2024-50035