Bug 2270110 (CVE-2024-26636)

Summary: CVE-2024-26636 kernel: llc: make llc_ui_sendmsg() more robust against bonding changes
Product: [Other] Security Response Reporter: Zack Miele <zmiele>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: acaringi, allarkin, aquini, bhu, chwhite, dbohanno, debarbos, dfreiber, drow, dvlasenk, esandeen, ezulian, hkrzesin, jarod, jburrell, jfaracco, jforbes, jlelli, joe.lawrence, jshortt, jstancek, jwyatt, ldoskova, lgoncalv, mleitner, mmilgram, mstowell, nmurray, ptalbert, rparrazo, rrobaina, rvrbovsk, scweaver, sidakwo, sukulkar, tglozar, vkumar, wcosta, williams, wmealing, ycote, ykopkova
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: kernel 4.19.307, kernel 5.4.269, kernel 5.10.210, kernel 5.15.149, kernel 6.1.76, kernel 6.6.15, kernel 6.7.3, kernel 6.8 Doc Type: If docs needed, set a value
Doc Text:
A vulnerability was found in llc protocol in Linux Kernel allows llc_ui_sendmsg() to allocate a socket buffer (skb) with insufficient headroom and later attempt to push 14 bytes of Ethernet header. This occurred because the function released the socket lock before allocating the skb and did not revalidate sanity checks upon reacquiring the lock. This could lead to system instability or DoS.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2270111    
Bug Blocks: 2270180    

Description Zack Miele 2024-03-18 13:40:31 UTC 
In the Linux kernel, the following vulnerability has been resolved:

llc: make llc_ui_sendmsg() more robust against bonding changes

The Linux kernel CVE team has assigned CVE-2024-26636 to this issue.

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/20240318101458.2835626-14-lee@kernel.org/T
Comment 1 Zack Miele 2024-03-18 13:41:03 UTC 
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 2270111]
Comment 5 Justin M. Forbes 2024-03-25 19:41:08 UTC 
This was fixed for Fedora with the 6.7.3 stable kernel updates.
Comment 6 Alex 2024-06-09 13:10:33 UTC 
The result of automatic check (that is developed by Alexander Larkin) for this CVE-2024-26636 is: 	SKIP	No affected files built, so skip this CVE	NO			-	-	unknown (where first YES/NO value means if related sources built).