CVE-2023-52845 (GCVE-0-2023-52845)

Vulnerability from cvelistv5 – Published: 2024-05-21 15:31 – Updated: 2026-08-05 09:11
VLAI
Title
tipc: Change nla_policy for bearer-related names to NLA_NUL_STRING
Summary
In the Linux kernel, the following vulnerability has been resolved: tipc: Change nla_policy for bearer-related names to NLA_NUL_STRING syzbot reported the following uninit-value access issue [1]: ===================================================== BUG: KMSAN: uninit-value in strlen lib/string.c:418 [inline] BUG: KMSAN: uninit-value in strstr+0xb8/0x2f0 lib/string.c:756 strlen lib/string.c:418 [inline] strstr+0xb8/0x2f0 lib/string.c:756 tipc_nl_node_reset_link_stats+0x3ea/0xb50 net/tipc/node.c:2595 genl_family_rcv_msg_doit net/netlink/genetlink.c:971 [inline] genl_family_rcv_msg net/netlink/genetlink.c:1051 [inline] genl_rcv_msg+0x11ec/0x1290 net/netlink/genetlink.c:1066 netlink_rcv_skb+0x371/0x650 net/netlink/af_netlink.c:2545 genl_rcv+0x40/0x60 net/netlink/genetlink.c:1075 netlink_unicast_kernel net/netlink/af_netlink.c:1342 [inline] netlink_unicast+0xf47/0x1250 net/netlink/af_netlink.c:1368 netlink_sendmsg+0x1238/0x13d0 net/netlink/af_netlink.c:1910 sock_sendmsg_nosec net/socket.c:730 [inline] sock_sendmsg net/socket.c:753 [inline] ____sys_sendmsg+0x9c2/0xd60 net/socket.c:2541 ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2595 __sys_sendmsg net/socket.c:2624 [inline] __do_sys_sendmsg net/socket.c:2633 [inline] __se_sys_sendmsg net/socket.c:2631 [inline] __x64_sys_sendmsg+0x307/0x490 net/socket.c:2631 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd Uninit was created at: slab_post_alloc_hook+0x12f/0xb70 mm/slab.h:767 slab_alloc_node mm/slub.c:3478 [inline] kmem_cache_alloc_node+0x577/0xa80 mm/slub.c:3523 kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:559 __alloc_skb+0x318/0x740 net/core/skbuff.c:650 alloc_skb include/linux/skbuff.h:1286 [inline] netlink_alloc_large_skb net/netlink/af_netlink.c:1214 [inline] netlink_sendmsg+0xb34/0x13d0 net/netlink/af_netlink.c:1885 sock_sendmsg_nosec net/socket.c:730 [inline] sock_sendmsg net/socket.c:753 [inline] ____sys_sendmsg+0x9c2/0xd60 net/socket.c:2541 ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2595 __sys_sendmsg net/socket.c:2624 [inline] __do_sys_sendmsg net/socket.c:2633 [inline] __se_sys_sendmsg net/socket.c:2631 [inline] __x64_sys_sendmsg+0x307/0x490 net/socket.c:2631 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd TIPC bearer-related names including link names must be null-terminated strings. If a link name which is not null-terminated is passed through netlink, strstr() and similar functions can cause buffer overrun. This causes the above issue. This patch changes the nla_policy for bearer-related names from NLA_STRING to NLA_NUL_STRING. This resolves the issue by ensuring that only null-terminated strings are accepted as bearer-related names. syzbot reported similar uninit-value issue related to bearer names [2]. The root cause of this issue is that a non-null-terminated bearer name was passed. This patch also resolved this issue.
Severity
7.1 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 0655f6a8635b1b66f2434d5556b1044c14b1ccaf , < 6744008c354bca2e4686a5b6056ee6b535d9f67d (git)
Affected: 0655f6a8635b1b66f2434d5556b1044c14b1ccaf , < 2426425d686b43adbc4f2f4a367b494f06f159d6 (git)
Affected: 0655f6a8635b1b66f2434d5556b1044c14b1ccaf , < 2199260c42e6fbc5af8adae3bf78e623407c91b0 (git)
Affected: 0655f6a8635b1b66f2434d5556b1044c14b1ccaf , < b33d130f07f1decd756b849ab03c23d11d4dd294 (git)
Affected: 0655f6a8635b1b66f2434d5556b1044c14b1ccaf , < 3907b89cd17fcc23e9a80789c36856f00ece0ba8 (git)
Affected: 0655f6a8635b1b66f2434d5556b1044c14b1ccaf , < 4c731e98fe4d678e87ba3e4d45d3cf0a5a193dc4 (git)
Affected: 0655f6a8635b1b66f2434d5556b1044c14b1ccaf , < abc1582119e8c4af14cedb0db6541fd603f45a04 (git)
Affected: 0655f6a8635b1b66f2434d5556b1044c14b1ccaf , < 560992f41c0cea44b7603bc9e6c73bffbf6b5709 (git)
Affected: 0655f6a8635b1b66f2434d5556b1044c14b1ccaf , < 19b3f72a41a8751e26bffc093bb7e1cef29ad579 (git)
Create a notification for this product.
Linux Linux Affected: 3.19
Unaffected: 0 , < 3.19 (semver)
Unaffected: 4.14.330 , ≤ 4.14.* (semver)
Unaffected: 4.19.299 , ≤ 4.19.* (semver)
Unaffected: 5.4.261 , ≤ 5.4.* (semver)
Unaffected: 5.10.201 , ≤ 5.10.* (semver)
Unaffected: 5.15.139 , ≤ 5.15.* (semver)
Unaffected: 6.1.63 , ≤ 6.1.* (semver)
Unaffected: 6.5.12 , ≤ 6.5.* (semver)
Unaffected: 6.6.2 , ≤ 6.6.* (semver)
Unaffected: 6.7 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T23:11:35.894Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/6744008c354bca2e4686a5b6056ee6b535d9f67d"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/2426425d686b43adbc4f2f4a367b494f06f159d6"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/2199260c42e6fbc5af8adae3bf78e623407c91b0"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/b33d130f07f1decd756b849ab03c23d11d4dd294"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/3907b89cd17fcc23e9a80789c36856f00ece0ba8"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/4c731e98fe4d678e87ba3e4d45d3cf0a5a193dc4"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/abc1582119e8c4af14cedb0db6541fd603f45a04"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/560992f41c0cea44b7603bc9e6c73bffbf6b5709"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/19b3f72a41a8751e26bffc093bb7e1cef29ad579"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-52845",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T15:36:31.255258Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:32:54.283Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/tipc/netlink.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6744008c354bca2e4686a5b6056ee6b535d9f67d",
              "status": "affected",
              "version": "0655f6a8635b1b66f2434d5556b1044c14b1ccaf",
              "versionType": "git"
            },
            {
              "lessThan": "2426425d686b43adbc4f2f4a367b494f06f159d6",
              "status": "affected",
              "version": "0655f6a8635b1b66f2434d5556b1044c14b1ccaf",
              "versionType": "git"
            },
            {
              "lessThan": "2199260c42e6fbc5af8adae3bf78e623407c91b0",
              "status": "affected",
              "version": "0655f6a8635b1b66f2434d5556b1044c14b1ccaf",
              "versionType": "git"
            },
            {
              "lessThan": "b33d130f07f1decd756b849ab03c23d11d4dd294",
              "status": "affected",
              "version": "0655f6a8635b1b66f2434d5556b1044c14b1ccaf",
              "versionType": "git"
            },
            {
              "lessThan": "3907b89cd17fcc23e9a80789c36856f00ece0ba8",
              "status": "affected",
              "version": "0655f6a8635b1b66f2434d5556b1044c14b1ccaf",
              "versionType": "git"
            },
            {
              "lessThan": "4c731e98fe4d678e87ba3e4d45d3cf0a5a193dc4",
              "status": "affected",
              "version": "0655f6a8635b1b66f2434d5556b1044c14b1ccaf",
              "versionType": "git"
            },
            {
              "lessThan": "abc1582119e8c4af14cedb0db6541fd603f45a04",
              "status": "affected",
              "version": "0655f6a8635b1b66f2434d5556b1044c14b1ccaf",
              "versionType": "git"
            },
            {
              "lessThan": "560992f41c0cea44b7603bc9e6c73bffbf6b5709",
              "status": "affected",
              "version": "0655f6a8635b1b66f2434d5556b1044c14b1ccaf",
              "versionType": "git"
            },
            {
              "lessThan": "19b3f72a41a8751e26bffc093bb7e1cef29ad579",
              "status": "affected",
              "version": "0655f6a8635b1b66f2434d5556b1044c14b1ccaf",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/tipc/netlink.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.19"
            },
            {
              "lessThan": "3.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.14.*",
              "status": "unaffected",
              "version": "4.14.330",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.299",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.201",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.139",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.63",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.5.*",
              "status": "unaffected",
              "version": "6.5.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.7",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.14.330",
                  "versionStartIncluding": "3.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.299",
                  "versionStartIncluding": "3.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.261",
                  "versionStartIncluding": "3.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.201",
                  "versionStartIncluding": "3.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.139",
                  "versionStartIncluding": "3.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.63",
                  "versionStartIncluding": "3.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.5.12",
                  "versionStartIncluding": "3.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.2",
                  "versionStartIncluding": "3.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7",
                  "versionStartIncluding": "3.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: Change nla_policy for bearer-related names to NLA_NUL_STRING\n\nsyzbot reported the following uninit-value access issue [1]:\n\n=====================================================\nBUG: KMSAN: uninit-value in strlen lib/string.c:418 [inline]\nBUG: KMSAN: uninit-value in strstr+0xb8/0x2f0 lib/string.c:756\n strlen lib/string.c:418 [inline]\n strstr+0xb8/0x2f0 lib/string.c:756\n tipc_nl_node_reset_link_stats+0x3ea/0xb50 net/tipc/node.c:2595\n genl_family_rcv_msg_doit net/netlink/genetlink.c:971 [inline]\n genl_family_rcv_msg net/netlink/genetlink.c:1051 [inline]\n genl_rcv_msg+0x11ec/0x1290 net/netlink/genetlink.c:1066\n netlink_rcv_skb+0x371/0x650 net/netlink/af_netlink.c:2545\n genl_rcv+0x40/0x60 net/netlink/genetlink.c:1075\n netlink_unicast_kernel net/netlink/af_netlink.c:1342 [inline]\n netlink_unicast+0xf47/0x1250 net/netlink/af_netlink.c:1368\n netlink_sendmsg+0x1238/0x13d0 net/netlink/af_netlink.c:1910\n sock_sendmsg_nosec net/socket.c:730 [inline]\n sock_sendmsg net/socket.c:753 [inline]\n ____sys_sendmsg+0x9c2/0xd60 net/socket.c:2541\n ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2595\n __sys_sendmsg net/socket.c:2624 [inline]\n __do_sys_sendmsg net/socket.c:2633 [inline]\n __se_sys_sendmsg net/socket.c:2631 [inline]\n __x64_sys_sendmsg+0x307/0x490 net/socket.c:2631\n do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80\n entry_SYSCALL_64_after_hwframe+0x63/0xcd\n\nUninit was created at:\n slab_post_alloc_hook+0x12f/0xb70 mm/slab.h:767\n slab_alloc_node mm/slub.c:3478 [inline]\n kmem_cache_alloc_node+0x577/0xa80 mm/slub.c:3523\n kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:559\n __alloc_skb+0x318/0x740 net/core/skbuff.c:650\n alloc_skb include/linux/skbuff.h:1286 [inline]\n netlink_alloc_large_skb net/netlink/af_netlink.c:1214 [inline]\n netlink_sendmsg+0xb34/0x13d0 net/netlink/af_netlink.c:1885\n sock_sendmsg_nosec net/socket.c:730 [inline]\n sock_sendmsg net/socket.c:753 [inline]\n ____sys_sendmsg+0x9c2/0xd60 net/socket.c:2541\n ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2595\n __sys_sendmsg net/socket.c:2624 [inline]\n __do_sys_sendmsg net/socket.c:2633 [inline]\n __se_sys_sendmsg net/socket.c:2631 [inline]\n __x64_sys_sendmsg+0x307/0x490 net/socket.c:2631\n do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80\n entry_SYSCALL_64_after_hwframe+0x63/0xcd\n\nTIPC bearer-related names including link names must be null-terminated\nstrings. If a link name which is not null-terminated is passed through\nnetlink, strstr() and similar functions can cause buffer overrun. This\ncauses the above issue.\n\nThis patch changes the nla_policy for bearer-related names from NLA_STRING\nto NLA_NUL_STRING. This resolves the issue by ensuring that only\nnull-terminated strings are accepted as bearer-related names.\n\nsyzbot reported similar uninit-value issue related to bearer names [2]. The\nroot cause of this issue is that a non-null-terminated bearer name was\npassed. This patch also resolved this issue."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is reached only via local genetlink netlink (sendmsg \u2192 tipc_nl_node_reset_link_stats / bearer ops). Remote TIPC packet processing does not parse these netlink name attributes.\nAC:L - An attacker can deterministically trigger the bug by sending a crafted genetlink message with a non-NUL-terminated TIPC_NLA_LINK_NAME or TIPC_NLA_BEARER_NAME; no race or attacker-uncontrollable condition is required.\nPR:L - tipc_genl_v2_ops carry no GENL_ADMIN_PERM (unlike the legacy compat path\u2019s CAP_NET_ADMIN check), so any unprivileged local user can invoke the vulnerable commands when tipc is loaded.\nUI:N - Exploitation requires only attacker-sent netlink messages; no separate victim action is needed.\nS:U - Impact remains within the host kernel tipc/netlink authority and does not cross a VM, IOMMU, or other security boundary.\nC:H - NLA_STRING allows non-NUL-terminated names up to TIPC_MAX_LINK_NAME/BEARER_NAME, after which strstr/strcmp/strlen perform an unbounded out-of-bounds kernel read past the attribute into adjacent skb/slab memory; per kernel CNA guidance such OOB reads are High unless strictly bounded.\nI:N - The defect is a read-only over-read; bearer enable copies go through strscpy-bounded bearer_name_validate before strcpy into b-\u003ename, so there is no OOB write or control-flow hijack primitive from this bug.\nA:H - Unbounded string walks past the netlink attribute/skb object can touch unmapped memory and oops/panic the kernel, which is High availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T09:11:38.672Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/6744008c354bca2e4686a5b6056ee6b535d9f67d"
        },
        {
          "url": "https://git.kernel.org/stable/c/2426425d686b43adbc4f2f4a367b494f06f159d6"
        },
        {
          "url": "https://git.kernel.org/stable/c/2199260c42e6fbc5af8adae3bf78e623407c91b0"
        },
        {
          "url": "https://git.kernel.org/stable/c/b33d130f07f1decd756b849ab03c23d11d4dd294"
        },
        {
          "url": "https://git.kernel.org/stable/c/3907b89cd17fcc23e9a80789c36856f00ece0ba8"
        },
        {
          "url": "https://git.kernel.org/stable/c/4c731e98fe4d678e87ba3e4d45d3cf0a5a193dc4"
        },
        {
          "url": "https://git.kernel.org/stable/c/abc1582119e8c4af14cedb0db6541fd603f45a04"
        },
        {
          "url": "https://git.kernel.org/stable/c/560992f41c0cea44b7603bc9e6c73bffbf6b5709"
        },
        {
          "url": "https://git.kernel.org/stable/c/19b3f72a41a8751e26bffc093bb7e1cef29ad579"
        }
      ],
      "title": "tipc: Change nla_policy for bearer-related names to NLA_NUL_STRING",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-52845",
    "datePublished": "2024-05-21T15:31:43.181Z",
    "dateReserved": "2024-05-21T15:19:24.254Z",
    "dateUpdated": "2026-08-05T09:11:38.672Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-52845",
      "date": "2026-08-09",
      "epss": "0.00271",
      "percentile": "0.1901"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-52845\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-05-21T16:15:21.723\",\"lastModified\":\"2026-06-17T06:43:43.113\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ntipc: Change nla_policy for bearer-related names to NLA_NUL_STRING\\n\\nsyzbot reported the following uninit-value access issue [1]:\\n\\n=====================================================\\nBUG: KMSAN: uninit-value in strlen lib/string.c:418 [inline]\\nBUG: KMSAN: uninit-value in strstr+0xb8/0x2f0 lib/string.c:756\\n strlen lib/string.c:418 [inline]\\n strstr+0xb8/0x2f0 lib/string.c:756\\n tipc_nl_node_reset_link_stats+0x3ea/0xb50 net/tipc/node.c:2595\\n genl_family_rcv_msg_doit net/netlink/genetlink.c:971 [inline]\\n genl_family_rcv_msg net/netlink/genetlink.c:1051 [inline]\\n genl_rcv_msg+0x11ec/0x1290 net/netlink/genetlink.c:1066\\n netlink_rcv_skb+0x371/0x650 net/netlink/af_netlink.c:2545\\n genl_rcv+0x40/0x60 net/netlink/genetlink.c:1075\\n netlink_unicast_kernel net/netlink/af_netlink.c:1342 [inline]\\n netlink_unicast+0xf47/0x1250 net/netlink/af_netlink.c:1368\\n netlink_sendmsg+0x1238/0x13d0 net/netlink/af_netlink.c:1910\\n sock_sendmsg_nosec net/socket.c:730 [inline]\\n sock_sendmsg net/socket.c:753 [inline]\\n ____sys_sendmsg+0x9c2/0xd60 net/socket.c:2541\\n ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2595\\n __sys_sendmsg net/socket.c:2624 [inline]\\n __do_sys_sendmsg net/socket.c:2633 [inline]\\n __se_sys_sendmsg net/socket.c:2631 [inline]\\n __x64_sys_sendmsg+0x307/0x490 net/socket.c:2631\\n do_syscall_x64 arch/x86/entry/common.c:50 [inline]\\n do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80\\n entry_SYSCALL_64_after_hwframe+0x63/0xcd\\n\\nUninit was created at:\\n slab_post_alloc_hook+0x12f/0xb70 mm/slab.h:767\\n slab_alloc_node mm/slub.c:3478 [inline]\\n kmem_cache_alloc_node+0x577/0xa80 mm/slub.c:3523\\n kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:559\\n __alloc_skb+0x318/0x740 net/core/skbuff.c:650\\n alloc_skb include/linux/skbuff.h:1286 [inline]\\n netlink_alloc_large_skb net/netlink/af_netlink.c:1214 [inline]\\n netlink_sendmsg+0xb34/0x13d0 net/netlink/af_netlink.c:1885\\n sock_sendmsg_nosec net/socket.c:730 [inline]\\n sock_sendmsg net/socket.c:753 [inline]\\n ____sys_sendmsg+0x9c2/0xd60 net/socket.c:2541\\n ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2595\\n __sys_sendmsg net/socket.c:2624 [inline]\\n __do_sys_sendmsg net/socket.c:2633 [inline]\\n __se_sys_sendmsg net/socket.c:2631 [inline]\\n __x64_sys_sendmsg+0x307/0x490 net/socket.c:2631\\n do_syscall_x64 arch/x86/entry/common.c:50 [inline]\\n do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80\\n entry_SYSCALL_64_after_hwframe+0x63/0xcd\\n\\nTIPC bearer-related names including link names must be null-terminated\\nstrings. If a link name which is not null-terminated is passed through\\nnetlink, strstr() and similar functions can cause buffer overrun. This\\ncauses the above issue.\\n\\nThis patch changes the nla_policy for bearer-related names from NLA_STRING\\nto NLA_NUL_STRING. This resolves the issue by ensuring that only\\nnull-terminated strings are accepted as bearer-related names.\\n\\nsyzbot reported similar uninit-value issue related to bearer names [2]. The\\nroot cause of this issue is that a non-null-terminated bearer name was\\npassed. This patch also resolved this issue.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: tipc: Cambiar nla_policy para nombres relacionados con el portador a NLA_NUL_STRING syzbot inform\u00f3 el siguiente problema de acceso de valor uninit [1]: ============== ======================================= BUG: KMSAN: valor uninit en strlen lib/ string.c:418 [en l\u00ednea] BUG: KMSAN: valor uninit en strstr+0xb8/0x2f0 lib/string.c:756 strlen lib/string.c:418 [en l\u00ednea] strstr+0xb8/0x2f0 lib/string.c: 756 tipc_nl_node_reset_link_stats+0x3ea/0xb50 net/tipc/node.c:2595 genl_family_rcv_msg_doit net/netlink/genetlink.c:971 [en l\u00ednea] genl_family_rcv_msg net/netlink/genetlink.c:1051 [en l\u00ednea] 0x1290 red/enlace de red/ genetlink.c:1066 netlink_rcv_skb+0x371/0x650 net/netlink/af_netlink.c:2545 genl_rcv+0x40/0x60 net/netlink/genetlink.c:1075 netlink_unicast_kernel net/netlink/af_netlink.c:1342 [en l\u00ednea] netlink_unicast+0xf47/ 0x1250 net/netlink/af_netlink.c:1368 netlink_sendmsg+0x1238/0x13d0 net/netlink/af_netlink.c:1910 sock_sendmsg_nosec net/socket.c:730 [en l\u00ednea] sock_sendmsg net/socket.c:753 [en l\u00ednea] 2/ 0xd60 net/socket.c:2541 ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2595 __sys_sendmsg net/socket.c:2624 [en l\u00ednea] __do_sys_sendmsg net/socket.c:2633 [en l\u00ednea] __se_sys_sendmsg red/socket. c:2631 [en l\u00ednea] __x64_sys_sendmsg+0x307/0x490 net/socket.c:2631 do_syscall_x64 arch/x86/entry/common.c:50 [en l\u00ednea] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 Entry_SYSCALL_64_after_hwframe+0 x63/ 0xcd Uninit se cre\u00f3 en: slab_post_alloc_hook+0x12f/0xb70 mm/slab.h:767 slab_alloc_node mm/slub.c:3478 [en l\u00ednea] kmem_cache_alloc_node+0x577/0xa80 mm/slub.c:3523 kmalloc_reserve+0x13d/0x4a0 net/ n\u00facleo/ skbuff.c:559 __alloc_skb+0x318/0x740 net/core/skbuff.c:650 alloc_skb include/linux/skbuff.h:1286 [en l\u00ednea] netlink_alloc_large_skb net/netlink/af_netlink.c:1214 [en l\u00ednea] netlink_sendmsg+0xb34/0x13d0 net/netlink/af_netlink.c:1885 sock_sendmsg_nosec net/socket.c:730 [en l\u00ednea] sock_sendmsg net/socket.c:753 [en l\u00ednea] ____sys_sendmsg+0x9c2/0xd60 net/socket.c:2541 ___sys_sendmsg+0x28d/0x3c0 net/ socket.c:2595 __sys_sendmsg net/socket.c:2624 [en l\u00ednea] __do_sys_sendmsg net/socket.c:2633 [en l\u00ednea] __se_sys_sendmsg net/socket.c:2631 [en l\u00ednea] __x64_sys_sendmsg+0x307/0x490 :2631 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 Entry_SYSCALL_64_after_hwframe+0x63/0xcd Los nombres relacionados con el portador TIPC, incluidos los nombres de enlaces, deben ser cadenas terminadas en nulo . Si un nombre de enlace que no termina en nulo se pasa a trav\u00e9s de netlink, strstr() y funciones similares pueden provocar una saturaci\u00f3n del b\u00fafer. Esto causa el problema anterior. Este parche cambia la nla_policy para nombres relacionados con el portador de NLA_STRING a NLA_NUL_STRING. Esto resuelve el problema garantizando que s\u00f3lo se acepten cadenas terminadas en nulo como nombres relacionados con el portador. syzbot inform\u00f3 un problema similar de valor uninitario relacionado con los nombres de los portadores [2]. La causa principal de este problema es que se pas\u00f3 un nombre de portador no terminado en nulo. Este parche tambi\u00e9n resolvi\u00f3 este problema.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/tipc/netlink.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"0655f6a8635b1b66f2434d5556b1044c14b1ccaf\",\"lessThan\":\"6744008c354bca2e4686a5b6056ee6b535d9f67d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0655f6a8635b1b66f2434d5556b1044c14b1ccaf\",\"lessThan\":\"2426425d686b43adbc4f2f4a367b494f06f159d6\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0655f6a8635b1b66f2434d5556b1044c14b1ccaf\",\"lessThan\":\"2199260c42e6fbc5af8adae3bf78e623407c91b0\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0655f6a8635b1b66f2434d5556b1044c14b1ccaf\",\"lessThan\":\"b33d130f07f1decd756b849ab03c23d11d4dd294\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0655f6a8635b1b66f2434d5556b1044c14b1ccaf\",\"lessThan\":\"3907b89cd17fcc23e9a80789c36856f00ece0ba8\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0655f6a8635b1b66f2434d5556b1044c14b1ccaf\",\"lessThan\":\"4c731e98fe4d678e87ba3e4d45d3cf0a5a193dc4\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0655f6a8635b1b66f2434d5556b1044c14b1ccaf\",\"lessThan\":\"abc1582119e8c4af14cedb0db6541fd603f45a04\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0655f6a8635b1b66f2434d5556b1044c14b1ccaf\",\"lessThan\":\"560992f41c0cea44b7603bc9e6c73bffbf6b5709\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0655f6a8635b1b66f2434d5556b1044c14b1ccaf\",\"lessThan\":\"19b3f72a41a8751e26bffc093bb7e1cef29ad579\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/tipc/netlink.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"3.19\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"3.19\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"4.14.330\",\"lessThanOrEqual\":\"4.14.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"4.19.299\",\"lessThanOrEqual\":\"4.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.261\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.201\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.139\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.63\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.5.12\",\"lessThanOrEqual\":\"6.5.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.2\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.7\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-09-10T15:36:31.255258Z\",\"id\":\"CVE-2023-52845\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-908\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.19\",\"versionEndExcluding\":\"4.14.330\",\"matchCriteriaId\":\"D55230F7-7217-4456-9084-D546ABA9C781\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.15\",\"versionEndExcluding\":\"4.19.299\",\"matchCriteriaId\":\"F51D1457-86F8-4A6C-A7B9-323058B3C5E8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.20\",\"versionEndExcluding\":\"5.4.261\",\"matchCriteriaId\":\"286E50BB-5A21-49BA-A6E5-526C72ADFE34\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.201\",\"matchCriteriaId\":\"AF1ADC4E-CCC4-498A-876F-5136DDD36C1D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.139\",\"matchCriteriaId\":\"81424D14-B38F-47B3-A1B8-BC3B60BB96EA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.63\",\"matchCriteriaId\":\"80E1EA7E-2788-466C-9FFB-34AFA1B052F0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.5.12\",\"matchCriteriaId\":\"825F64D9-E99F-49AA-8A7B-EF7C2965C5B2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.6\",\"versionEndExcluding\":\"6.6.2\",\"matchCriteriaId\":\"4CBFF885-A4D3-4F21-B6FD-4D770034C048\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/19b3f72a41a8751e26bffc093bb7e1cef29ad579\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/2199260c42e6fbc5af8adae3bf78e623407c91b0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/2426425d686b43adbc4f2f4a367b494f06f159d6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/3907b89cd17fcc23e9a80789c36856f00ece0ba8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/4c731e98fe4d678e87ba3e4d45d3cf0a5a193dc4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/560992f41c0cea44b7603bc9e6c73bffbf6b5709\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/6744008c354bca2e4686a5b6056ee6b535d9f67d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/abc1582119e8c4af14cedb0db6541fd603f45a04\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b33d130f07f1decd756b849ab03c23d11d4dd294\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/19b3f72a41a8751e26bffc093bb7e1cef29ad579\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/2199260c42e6fbc5af8adae3bf78e623407c91b0\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/2426425d686b43adbc4f2f4a367b494f06f159d6\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/3907b89cd17fcc23e9a80789c36856f00ece0ba8\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/4c731e98fe4d678e87ba3e4d45d3cf0a5a193dc4\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/560992f41c0cea44b7603bc9e6c73bffbf6b5709\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/6744008c354bca2e4686a5b6056ee6b535d9f67d\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/abc1582119e8c4af14cedb0db6541fd603f45a04\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b33d130f07f1decd756b849ab03c23d11d4dd294\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-04T22:55:53+00:00",
      "cve": "CVE-2023-52845",
      "id": "CVE-2023-52845",
      "initial_release_date": "2023-01-01T00:00:00+00:00",
      "product_status:fixed": "150",
      "product_status:known_affected": "108",
      "product_status:known_not_affected": "42",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: tipc: Change nla_policy for bearer-related names to NLA_NUL_STRING",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-52845.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/6744008c354bca2e4686a5b6056ee6b535d9f67d\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/2426425d686b43adbc4f2f4a367b494f06f159d6\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/2199260c42e6fbc5af8adae3bf78e623407c91b0\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/b33d130f07f1decd756b849ab03c23d11d4dd294\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/3907b89cd17fcc23e9a80789c36856f00ece0ba8\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/4c731e98fe4d678e87ba3e4d45d3cf0a5a193dc4\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/abc1582119e8c4af14cedb0db6541fd603f45a04\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/560992f41c0cea44b7603bc9e6c73bffbf6b5709\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/19b3f72a41a8751e26bffc093bb7e1cef29ad579\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T23:11:35.894Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2023-52845\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T15:36:31.255258Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:13.338Z\"}}], \"cna\": {\"title\": \"tipc: Change nla_policy for bearer-related names to NLA_NUL_STRING\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.1, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The vulnerable code is reached only via local genetlink netlink (sendmsg \\u2192 tipc_nl_node_reset_link_stats / bearer ops). Remote TIPC packet processing does not parse these netlink name attributes.\\nAC:L - An attacker can deterministically trigger the bug by sending a crafted genetlink message with a non-NUL-terminated TIPC_NLA_LINK_NAME or TIPC_NLA_BEARER_NAME; no race or attacker-uncontrollable condition is required.\\nPR:L - tipc_genl_v2_ops carry no GENL_ADMIN_PERM (unlike the legacy compat path\\u2019s CAP_NET_ADMIN check), so any unprivileged local user can invoke the vulnerable commands when tipc is loaded.\\nUI:N - Exploitation requires only attacker-sent netlink messages; no separate victim action is needed.\\nS:U - Impact remains within the host kernel tipc/netlink authority and does not cross a VM, IOMMU, or other security boundary.\\nC:H - NLA_STRING allows non-NUL-terminated names up to TIPC_MAX_LINK_NAME/BEARER_NAME, after which strstr/strcmp/strlen perform an unbounded out-of-bounds kernel read past the attribute into adjacent skb/slab memory; per kernel CNA guidance such OOB reads are High unless strictly bounded.\\nI:N - The defect is a read-only over-read; bearer enable copies go through strscpy-bounded bearer_name_validate before strcpy into b-\u003ename, so there is no OOB write or control-flow hijack primitive from this bug.\\nA:H - Unbounded string walks past the netlink attribute/skb object can touch unmapped memory and oops/panic the kernel, which is High availability impact.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"0655f6a8635b1b66f2434d5556b1044c14b1ccaf\", \"lessThan\": \"6744008c354bca2e4686a5b6056ee6b535d9f67d\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"0655f6a8635b1b66f2434d5556b1044c14b1ccaf\", \"lessThan\": \"2426425d686b43adbc4f2f4a367b494f06f159d6\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"0655f6a8635b1b66f2434d5556b1044c14b1ccaf\", \"lessThan\": \"2199260c42e6fbc5af8adae3bf78e623407c91b0\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"0655f6a8635b1b66f2434d5556b1044c14b1ccaf\", \"lessThan\": \"b33d130f07f1decd756b849ab03c23d11d4dd294\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"0655f6a8635b1b66f2434d5556b1044c14b1ccaf\", \"lessThan\": \"3907b89cd17fcc23e9a80789c36856f00ece0ba8\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"0655f6a8635b1b66f2434d5556b1044c14b1ccaf\", \"lessThan\": \"4c731e98fe4d678e87ba3e4d45d3cf0a5a193dc4\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"0655f6a8635b1b66f2434d5556b1044c14b1ccaf\", \"lessThan\": \"abc1582119e8c4af14cedb0db6541fd603f45a04\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"0655f6a8635b1b66f2434d5556b1044c14b1ccaf\", \"lessThan\": \"560992f41c0cea44b7603bc9e6c73bffbf6b5709\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"0655f6a8635b1b66f2434d5556b1044c14b1ccaf\", \"lessThan\": \"19b3f72a41a8751e26bffc093bb7e1cef29ad579\", \"versionType\": \"git\"}], \"programFiles\": [\"net/tipc/netlink.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"3.19\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"3.19\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"4.14.330\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.14.*\"}, {\"status\": \"unaffected\", \"version\": \"4.19.299\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.19.*\"}, {\"status\": \"unaffected\", \"version\": \"5.4.261\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.201\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.139\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.63\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.5.12\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.5.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.2\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.7\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"net/tipc/netlink.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/6744008c354bca2e4686a5b6056ee6b535d9f67d\"}, {\"url\": \"https://git.kernel.org/stable/c/2426425d686b43adbc4f2f4a367b494f06f159d6\"}, {\"url\": \"https://git.kernel.org/stable/c/2199260c42e6fbc5af8adae3bf78e623407c91b0\"}, {\"url\": \"https://git.kernel.org/stable/c/b33d130f07f1decd756b849ab03c23d11d4dd294\"}, {\"url\": \"https://git.kernel.org/stable/c/3907b89cd17fcc23e9a80789c36856f00ece0ba8\"}, {\"url\": \"https://git.kernel.org/stable/c/4c731e98fe4d678e87ba3e4d45d3cf0a5a193dc4\"}, {\"url\": \"https://git.kernel.org/stable/c/abc1582119e8c4af14cedb0db6541fd603f45a04\"}, {\"url\": \"https://git.kernel.org/stable/c/560992f41c0cea44b7603bc9e6c73bffbf6b5709\"}, {\"url\": \"https://git.kernel.org/stable/c/19b3f72a41a8751e26bffc093bb7e1cef29ad579\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ntipc: Change nla_policy for bearer-related names to NLA_NUL_STRING\\n\\nsyzbot reported the following uninit-value access issue [1]:\\n\\n=====================================================\\nBUG: KMSAN: uninit-value in strlen lib/string.c:418 [inline]\\nBUG: KMSAN: uninit-value in strstr+0xb8/0x2f0 lib/string.c:756\\n strlen lib/string.c:418 [inline]\\n strstr+0xb8/0x2f0 lib/string.c:756\\n tipc_nl_node_reset_link_stats+0x3ea/0xb50 net/tipc/node.c:2595\\n genl_family_rcv_msg_doit net/netlink/genetlink.c:971 [inline]\\n genl_family_rcv_msg net/netlink/genetlink.c:1051 [inline]\\n genl_rcv_msg+0x11ec/0x1290 net/netlink/genetlink.c:1066\\n netlink_rcv_skb+0x371/0x650 net/netlink/af_netlink.c:2545\\n genl_rcv+0x40/0x60 net/netlink/genetlink.c:1075\\n netlink_unicast_kernel net/netlink/af_netlink.c:1342 [inline]\\n netlink_unicast+0xf47/0x1250 net/netlink/af_netlink.c:1368\\n netlink_sendmsg+0x1238/0x13d0 net/netlink/af_netlink.c:1910\\n sock_sendmsg_nosec net/socket.c:730 [inline]\\n sock_sendmsg net/socket.c:753 [inline]\\n ____sys_sendmsg+0x9c2/0xd60 net/socket.c:2541\\n ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2595\\n __sys_sendmsg net/socket.c:2624 [inline]\\n __do_sys_sendmsg net/socket.c:2633 [inline]\\n __se_sys_sendmsg net/socket.c:2631 [inline]\\n __x64_sys_sendmsg+0x307/0x490 net/socket.c:2631\\n do_syscall_x64 arch/x86/entry/common.c:50 [inline]\\n do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80\\n entry_SYSCALL_64_after_hwframe+0x63/0xcd\\n\\nUninit was created at:\\n slab_post_alloc_hook+0x12f/0xb70 mm/slab.h:767\\n slab_alloc_node mm/slub.c:3478 [inline]\\n kmem_cache_alloc_node+0x577/0xa80 mm/slub.c:3523\\n kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:559\\n __alloc_skb+0x318/0x740 net/core/skbuff.c:650\\n alloc_skb include/linux/skbuff.h:1286 [inline]\\n netlink_alloc_large_skb net/netlink/af_netlink.c:1214 [inline]\\n netlink_sendmsg+0xb34/0x13d0 net/netlink/af_netlink.c:1885\\n sock_sendmsg_nosec net/socket.c:730 [inline]\\n sock_sendmsg net/socket.c:753 [inline]\\n ____sys_sendmsg+0x9c2/0xd60 net/socket.c:2541\\n ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2595\\n __sys_sendmsg net/socket.c:2624 [inline]\\n __do_sys_sendmsg net/socket.c:2633 [inline]\\n __se_sys_sendmsg net/socket.c:2631 [inline]\\n __x64_sys_sendmsg+0x307/0x490 net/socket.c:2631\\n do_syscall_x64 arch/x86/entry/common.c:50 [inline]\\n do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80\\n entry_SYSCALL_64_after_hwframe+0x63/0xcd\\n\\nTIPC bearer-related names including link names must be null-terminated\\nstrings. If a link name which is not null-terminated is passed through\\nnetlink, strstr() and similar functions can cause buffer overrun. This\\ncauses the above issue.\\n\\nThis patch changes the nla_policy for bearer-related names from NLA_STRING\\nto NLA_NUL_STRING. This resolves the issue by ensuring that only\\nnull-terminated strings are accepted as bearer-related names.\\n\\nsyzbot reported similar uninit-value issue related to bearer names [2]. The\\nroot cause of this issue is that a non-null-terminated bearer name was\\npassed. This patch also resolved this issue.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.14.330\", \"versionStartIncluding\": \"3.19\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.19.299\", \"versionStartIncluding\": \"3.19\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.4.261\", \"versionStartIncluding\": \"3.19\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.201\", \"versionStartIncluding\": \"3.19\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.139\", \"versionStartIncluding\": \"3.19\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.63\", \"versionStartIncluding\": \"3.19\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.5.12\", \"versionStartIncluding\": \"3.19\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.2\", \"versionStartIncluding\": \"3.19\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.7\", \"versionStartIncluding\": \"3.19\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T09:11:38.672Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2023-52845\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T09:11:38.672Z\", \"dateReserved\": \"2024-05-21T15:19:24.254Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-05-21T15:31:43.181Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.