Executive Summary

This vulnerability exists in the Linux kernel's rtnetlink component, specifically in the function rtnl_fill_vfinfo. The function declares a struct ifla_vf_broadcast on the stack without initializing it fully. This struct has a 32-byte field, but only the first 6 bytes are overwritten with device broadcast data, leaving the remaining 26 bytes uninitialized and containing leftover kernel stack data.

When this struct is sent to userspace via a netlink message, it leaks up to 26 bytes of uninitialized kernel stack memory per virtual function (VF) per RTM_GETLINK request. This leaked data can include sensitive information such as return addresses and transient kernel data.

The vulnerability can be triggered by any unprivileged local process that can open AF_NETLINK/NETLINK_ROUTE sockets and send RTM_GETLINK requests with specific attributes, causing the kernel to expose this uninitialized stack data.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to information leakage from the kernel stack to unprivileged userspace processes. The leaked data may include sensitive kernel memory contents such as return addresses and other transient data.

An attacker could exploit this to gain insights into kernel memory layout, which might aid in further attacks such as privilege escalation or bypassing security mechanisms.

Since the vulnerability is reachable by any unprivileged local process, it increases the risk of local information disclosure without requiring elevated privileges.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by observing if unprivileged local processes are able to send RTM_GETLINK requests with an IFLA_EXT_MASK attribute carrying RTEXT_FILTER_VF and receive kernel stack data leakage in the IFLA_VF_BROADCAST field.

A practical detection method involves using a local user process to send a NETLINK_ROUTE RTM_GETLINK request with the appropriate filter and inspecting the response for leaked uninitialized kernel stack bytes.

While specific commands are not provided in the context, the vulnerability description implies that using tools or scripts that can send RTM_GETLINK requests via netlink sockets and parse the IFLA_VF_BROADCAST data could reveal the presence of the leak.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to apply the patch that zeroes the on-stack struct ifla_vf_broadcast before the partial memcpy operation in the rtnl_fill_vfinfo() function.

This patch matches the existing pattern used for other vf_* structs in the same function, preventing leakage of uninitialized kernel stack data.

Until the patch is applied, restricting unprivileged local users from sending RTM_GETLINK requests with IFLA_EXT_MASK carrying RTEXT_FILTER_VF can reduce the risk of exploitation.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability causes leakage of uninitialized kernel stack data, which can include return addresses and transient sensitive data, to unprivileged local processes. Such unintended exposure of sensitive information could potentially impact compliance with data protection regulations like GDPR and HIPAA, which require safeguarding personal and sensitive data against unauthorized access or disclosure.

However, the provided information does not explicitly discuss compliance implications or specific regulatory impacts.

Useful 0 Not Useful 0