Use of Uninitialized Sender Variables in batman-adv tp_meter

Executive Summary

This vulnerability exists in the Linux kernel's batman-adv module, specifically in the tp_meter component. The functions batadv_tp_recv_ack() and batadv_tp_stop() are designed to operate only when the tp_vars structure has the role BATADV_TP_SENDER. However, if these functions are called when the role is BATADV_TP_RECEIVER, they attempt to read sender-only variables that were never initialized. This leads to undefined behavior.

The issue can be triggered when a node acting as a receiver in an ongoing tp_meter session receives a malicious ACK packet. The fix involves checking the role immediately after looking up tp_vars and exiting early if the role is not BATADV_TP_SENDER, preventing access to uninitialized sender variables.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause undefined behavior in the Linux kernel's batman-adv module when a malicious ACK packet is received by a node acting as a receiver. Undefined behavior in kernel code can potentially lead to system instability, crashes, or other unpredictable outcomes, which may affect the reliability and security of the affected system.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability is resolved by ensuring that the functions batadv_tp_recv_ack() and batadv_tp_stop() only operate on tp_vars with the BATADV_TP_SENDER role. To mitigate this vulnerability immediately, you should update your Linux kernel to a version where this fix is applied.

Specifically, the fix involves checking the tp_vars->role immediately after lookup and exiting if it is not BATADV_TP_SENDER, preventing access to uninitialized sender-only members.

Until you can update, consider monitoring or blocking malicious ACK packets that could trigger this issue in ongoing tp_meter sessions.

Useful 0 Not Useful 0