[PATCH net] ip6mr: prevent info-leak in ip6mr_cache_report()

[PATCH net] ip6mr: prevent info-leak in ip6mr_cache_report()

[Henry Martin]

The non-WHOLEPKT branch copies the IPv6 header at offset 0 and then
appends 40 bytes with skb_put(), but the mrt6msg is written at offset 0
after skb_reset_transport_header(), so the appended 40 bytes are never
initialized.  They hold stale heap contents.

The report is queued to the mroute6 socket and copied into the
IP6MRA_CREPORT_PKT netlink attribute, disclosing the stale bytes to
user space.  The stale bytes can contain kernel heap and image
pointers, and the report is reachable from an unprivileged user
namespace (MRT6_INIT in a new netns, plus the non-root
RTNLGRP_IPV6_MROUTE_R group).

Use skb_put_zero() instead, as the IPv4 code does since
commit 4f34002e2e376 ("ipmr: prevent info-leak in pmr_cache_report()").

This issue was discovered by Tencent CodeBuddy Security.

Fixes: 7bc570c8b4f75 ("[IPV6] MROUTE: Support multicast forwarding.")
Cc: stable@vger.kernel.org
Signed-off-by: Henry Martin <bsdhenrymartin@gmail.com>
---
 net/ipv6/ip6mr.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
index dd0638d3c3f95..b7ae220d6b21d 100644
--- a/net/ipv6/ip6mr.c
+++ b/net/ipv6/ip6mr.c
@@ -1154,7 +1154,7 @@ static int ip6mr_cache_report(const struct mr_table *mrt, struct sk_buff *pkt,
 	/*
 	 *	Add our header
 	 */
-	skb_put(skb, sizeof(*msg));
+	skb_put_zero(skb, sizeof(*msg));
 	skb_reset_transport_header(skb);
 	msg = (struct mrt6msg *)skb_transport_header(skb);
 
-- 
2.43.7

Re: [PATCH net] ip6mr: prevent info-leak in ip6mr_cache_report()

[netdev-bot+sinfo]

Hi!

This is an automated message. This series looks like a fix, but its
commit messages seem to be missing some information:

 - Whether the issue was actually triggered, or is only theoretical
   (e.g. found by LLM and not proven at runtime). If it was triggered
   please include the symptoms, like the stack trace or kernel messages.

Please do not repost the series just to address the above. Instead,
reply to this email with the missing information, so that reviewers
can take it into account. If the series needs another revision for
other reasons, please include the information in the commit messages
then.

The evaluation is done by an LLM so it may be wrong, if you think
that is the case please reply and explain.