Skip to content

KMSAN Trophies

Jump to bottom
Alexander Potapenko edited this page Jan 16, 2020 · 24 revisions

Trophies

Bugs reported manually:

  1. tmp.b_page uninitialized in generic_block_bmap()
  2. strlen() called on non-terminated string in bind() for AF_PACKET
  3. too short socket address passed to selinux_socket_bind()
  4. uninitialized msg.msg_flags in recvfrom syscall
  5. incorrect input length validation in nl_fib_input()
  6. uninitialized sockc.tsflags in udpv6_sendmsg()
  7. incorrect input length validation in packet_getsockopt()
  8. incorrect input length validation in raw_send_hdrinc() and rawv6_send_hdrinc()
  9. missing check of nlmsg_parse() return value in rtnl_fdb_dump()
  10. Linux kernel 2.6.0 to 4.12-rc4 infoleak due to a data race in ALSA timer (CVE-2017-1000380)
    • Status: fixed upstream (1, 2)
  11. strlen() incorrectly called on user-supplied memory in dev_set_alias()
  12. waitid() copies uninitialized data to userspace (CVE-2017-14954)
  13. local infoleak via an SG_GET_REQUEST_TABLE ioctl call for /dev/sg0 (CVE-2017-14991)
  14. Uninitialized TCP request hash used in cookie_v[46]_check()
  15. _sctp_walk_params() and _sctp_walk_errors() dereference uninitialized pointers
  16. sctp_v6_to_addr() compared addresses to uninit data
  17. tun_get_user() accesses uninitialized data if skb->len is 0
  18. sctp_inet6_skb_msgname() leaks 4 bytes to the userspace
  19. Use of uninitialized memory in inet_ehash_insert()
  20. Buffer overflow in verify_address_len()
  21. Insufficient validation of user provided tunnel names in vti6_tnl_create() (syzbot)
  22. Information disclosure in vhost/vhost.c:vhost_new_msg() (CVE-2018-1118)

Confirmed bug reports by others:

  1. deprecated_sysctl_warning() reads uninit memory
  2. struct sockaddr length not checked in llcp_sock_connect()
  3. uninitialized default host->id in nvmf_host_default()

Bugs reported by syzbot (see also https://syzkaller.appspot.com/upstream/fixed?manager=ci-upstream-kmsan-gce)

  1. KMSAN: uninit-value in inet_csk_bind_conflict (fix by Eric Dumazet)

  2. KMSAN: uninit-value in packet_set_ring (fix by Eric Dumazet)

  3. KMSAN: uninit-value in neigh_dump_info (fix by Eric Dumazet)

  4. KMSAN: uninit-value in iptable_mangle_hook (fix by Eric Dumazet)

  5. KMSAN: uninit-value in pppoe_connect (fix by Guillaume Nault)

  6. KMSAN: uninit-value in __skb_try_recv_from_queue (fix by Eric Dumazet)

  7. KMSAN: uninit-value in memcmp (fix by Eric Dumazet) (duplicate)

  8. KMSAN: uninit-value in fib_create_info (fix by Eric Dumazet)

  9. KMSAN: uninit-value in netlink_sendmsg (fix by Eric Dumazet)

  10. KMSAN: uninit-value in inet6_rtm_delroute (fix by Eric Dumazet)

  11. KMSAN: uninit-value in fib6_new_table (fix by Eric Dumazet)

  12. KMSAN: uninit-value in ip_route_output_key_hash_rcu (fix by Eric Dumazet)

  13. KMSAN: uninit-value in sctp_sendmsg (fix by Eric Dumazet)

  14. KMSAN: uninit-value in tcp_parse_options (fix by Eric Dumazet)

  15. KMSAN: uninit-value in tipc_node_get_mtu (fix by Jon Maloy)

  16. KMSAN: uninit-value in netif_skb_features (fix by Toshiaki Makita)

  17. KMSAN: uninit-value in move_addr_to_user (fix by Eric Dumazet)

  18. KMSAN: uninit-value in sctp_do_bind (fix by Eric Dumazet)

  19. KMSAN: uninit-value in ip6table_mangle_hook (fix by Eric Dumazet)

  20. KMSAN: uninit-value in pppol2tp_connect (fix by Guillaume Nault)

  21. KMSAN: uninit-value in alg_bind (fix by Eric Dumazet)

  22. KMSAN: uninit-value in inet_getpeer (fix by Eric Dumazet)

  23. KMSAN: uninit-value in put_cmsg (fix by Eric Dumazet)

  24. KMSAN: uninit-value in rt6_multipath_hash (fix by Eric Dumazet)

  25. KMSAN: uninit-value in __sctp_v6_cmp_addr (fix by Xin Long)

  26. KMSAN: uninit-value in move_addr_to_user (fix by Eric Dumazet)

  27. KMSAN: uninit-value in strcmp (fix by Ying Xue)

  28. KMSAN: uninit-value in ebt_stp_mt_check (fix by Stephen Hemminger)

  29. KMSAN: uninit-value in ip_vs_lblc_check_expire (fix by Cong Wang)

  30. KMSAN: uninit-value in rtnetlink_put_metrics (fix by Eric Dumazet)

  31. KMSAN: uninit-value in eth_mac_addr (fix by Eric Dumazet)

  32. KMSAN: uninit-value in ebt_stp_mt_check (fix by Florian Westphal)

  33. KMSAN: uninit-value in nfqnl_recv_config (fix by Eric Dumazet)

  34. KMSAN: uninit-value in ip_vs_lblcr_check_expire (fix by Cong Wang)

  35. KMSAN: uninit-value in _copy_to_iter CVE-2018-1118 (fix by Kevin Easton)

  36. KMSAN: kernel-infoleak in vcs_read (fix by Alexander Potapenko)

  37. KMSAN: uninit-value in br_nf_forward_arp (fix by Willem de Bruijn)

  38. KMSAN: uninit-value in ip_tunnel_xmit (fix by Willem de Bruijn)

  39. KMSAN: uninit-value in af_alg_free_areq_sgls (fix by Stephan Mueller)

  40. KMSAN: kernel-infoleak in _copy_to_iter (fix by Eric Dumazet) (duplicate)

  41. KMSAN: uninit-value in gc_worker (fix by Florian Westphal)

  42. KMSAN: kernel-infoleak in put_cmsg (fix by Willem de Bruijn)

  43. KMSAN: uninit-value in __nf_conntrack_find_get (fix by Florian Westphal)

  44. KMSAN: uninit-value in do_msgrcv (fix by Manfred Spraul)

  45. KMSAN: uninit-value in snd_midi_event_encode_byte (fix by Takashi Iwai)

  46. KMSAN: uninit-value in pppoe_rcv (fix by Guillaume Nault)

  47. KMSAN: uninit-value in ip6_tnl_start_xmit (fix by Paolo Abeni)

  48. KMSAN: kernel-infoleak in _copy_to_iter (fix by Jon Maloy)

  49. KMSAN: uninit-value in vcs_read (fix by Alexander Potapenko)

  50. KMSAN: uninit-value in ip_tunnel_lookup (fix by Jiri Benc)

  51. KMSAN: uninit-value in dev_uc_add_excl (fix by Ido Schimmel)

  52. KMSAN: uninit-value in dev_mc_add_excl (fix by Ido Schimmel)

  53. KMSAN: uninit-value in synaptics_detect (fix by Dmitry Torokhov)

  54. KMSAN: kernel-infoleak in kvm_arch_vcpu_ioctl (fix by Liran Alon)

  55. KMSAN: kernel-infoleak in kvm_write_guest_page (fix by Liran Alon)

  56. KMSAN: uninit-value in linear_transfer (fix by Takashi Iwai)

  57. KMSAN: kernel-infoleak in _copy_to_iter (fix by Eric Dumazet)

  58. KMSAN: uninit-value in packet_sendmsg (fix by Willem de Bruijn)

  59. KMSAN: uninit-value in __inet6_bind (fix by Cong Wang)

  60. KMSAN: kernel-infoleak in sctp_getsockopt (fix by Xin Long)

  61. KMSAN: kernel-infoleak in capi_unlocked_ioctl (fix by Eric Dumazet)

  62. KMSAN: uninit-value in check_6rd (fix by Willem de Bruijn)

  63. KMSAN: uninit-value in vti6_tnl_xmit (fix by Willem de Bruijn)

  64. KMSAN: uninit-value in gue6_err (fix by Eric Dumazet)

  65. KMSAN: kernel-infoleak in sctp_getsockopt (2) (fix by Xin Long)

  66. KMSAN: uninit-value in tipc_conn_rcv_sub (fix by Ying Xue)

  67. KMSAN: uninit-value in gue_err (fix by Eric Dumazet)

  68. KMSAN: uninit-value in tipc_nl_compat_dumpit (fix by Ying Xue)

  69. KMSAN: kernel-infoleak in vmx_get_nested_state (fix by Tom Roeder)

  70. KMSAN: uninit-value in kvm_clear_dirty_log_protect (fix by Tomas Bortoli)

  71. KMSAN: uninit-value in tipc_nl_compat_link_reset_stats (fix by Ying Xue)

  72. KMSAN: kernel-infoleak in move_addr_to_user (fix by Eric Dumazet)

  73. KMSAN: uninit-value in tipc_nl_compat_bearer_enable (fix by Ying Xue)

  74. KMSAN: uninit-value in tipc_nl_compat_link_set (2) (fix by Ying Xue)

  75. KMSAN: uninit-value in tipc_nl_compat_name_table_dump (fix by Ying Xue)

  76. KMSAN: uninit-value in tipc_nl_compat_doit (fix by Ying Xue)

  77. KMSAN: kernel-infoleak in kvm_vcpu_write_guest_page (fix by Tom Roeder)

  78. KMSAN: uninit-value in tipc_subscrb_rcv_cb (fix by Ying Xue)

  79. KMSAN: uninit-value in batadv_interface_tx (fix by Eric Dumazet)

  80. KMSAN: uninit-value in mpol_rebind_mm (fix by Vlastimil Babka)

  81. KMSAN: kernel-infoleak in move_addr_to_user (2) (fix by Eric Dumazet)

  82. KMSAN: uninit-value in gue_err (2) (fix by Eric Dumazet)

  83. KMSAN: uninit-value in gue6_err (2) (fix by Eric Dumazet)

  84. KMSAN: kernel-infoleak in video_usercopy (fix by Hans Verkuil)

  85. KMSAN: uninit-value in mpol_rebind_mm (fix by Vlastimil Babka)

  86. KMSAN: uninit-value in tipc_nl_compat_bearer_enable (2) (fix by Xin Long)

  87. KMSAN: uninit-value in tipc_nl_compat_link_set (3) (fix by Xin Long)

  88. KMSAN: kernel-infoleak in sctp_getsockopt (3) (fix by Xin Long)

  89. KMSAN: uninit-value in tipc_nl_compat_name_table_dump (2) (fix by Xin Long)

  90. KMSAN: uninit-value in ip6_compressed_string (fix by Tetsuo Handa)

  91. KMSAN: uninit-value in tomoyo_check_unix_address (fix by Tetsuo Handa)

  92. KMSAN: uninit-value in rtnl_stats_get (fix by Eric Dumazet)

  93. KMSAN: uninit-value in rds_bind (fix by Tetsuo Handa)

  94. KMSAN: uninit-value in tomoyo_check_inet_address (fix by Tetsuo Handa)

  95. KMSAN: uninit-value in rtnl_stats_dump (fix by Eric Dumazet)

  96. KMSAN: uninit-value in rds_connect (fix by Tetsuo Handa)

  97. KMSAN: uninit-value in br_mdb_ip_get (fix by Nikolay Aleksandrov)

  98. KMSAN: uninit-value in aa_fqlookupn_profile (fix by Zubin Mithra)

  99. KMSAN: kernel-infoleak in copy_siginfo_to_user (2) (fix by Eric W. Biederman)

  100. KMSAN: uninit-value in tcp_create_openreq_child (fix by Eric Dumazet)

  101. KMSAN: uninit-value in tipc_nl_compat_bearer_disable (fix by Xin Long)

  102. KMSAN: uninit-value in bond_start_xmit (2) (fix by Cong Wang)

  103. KMSAN: uninit-value in ax88772_bind (fix by Phong Tran)

  104. KMSAN: uninit-value in read_eprom_word (fix by Denis Kirjanov)

  105. KMSAN: kernel-usb-infoleak in pcan_usb_pro_init (fix by Tomas Bortoli)

  106. KMSAN: kernel-usb-infoleak in pcan_usb_pro_send_req (fix by Tomas Bortoli)

  107. KMSAN: uninit-value in rtm_dump_nexthop (fix by David Ahern)

  108. KMSAN: uninit-value in batadv_netlink_dump_hardif (fix by Eric Dumazet)

  109. KMSAN: uninit-value in rtm_new_nexthop (fix by David Ahern)

  110. KMSAN: uninit-value in batadv_iv_send_outstanding_bat_ogm_packet (fix by Sven Eckelmann)

  111. KMSAN: uninit-value in capi_write (fix by Eric Biggers)

  112. KMSAN: uninit-value in sd_init (fix by Hans Verkuil)

  113. KMSAN: uninit-value in __request_module (fix by Cong Wang)

  114. KMSAN: uninit-value in i2c_w (fix by Hans Verkuil)

  115. KMSAN: uninit-value in inet_ehash_insert (fix by Eric Dumazet)

  116. KMSAN: kernel-usb-infoleak in ttusb_dec_send_command (fix by Tomas Bortoli)

  117. KMSAN: uninit-value in read_sensor_register (fix by Hans Verkuil)

  118. KMSAN: uninit-value in iowarrior_disconnect (fix by Johan Hovold)

  119. KMSAN: uninit-value in mts_usb_probe (fix by Johan Hovold)

  120. KMSAN: uninit-value in sr9800_bind (fix by Valentin Vidic)

  121. KMSAN: uninit-value in lg4ff_set_autocenter_default (fix by Alan Stern)

  122. KMSAN: use-after-free in rxrpc_put_peer (fix by David Howells)

  123. KMSAN: use-after-free in hidraw_ioctl (fix by Alan Stern)

  124. KMSAN: use-after-free in __pm_runtime_resume

  125. KMSAN: use-after-free in usb_autopm_put_interface (fix by Johan Hovold)

  126. KMSAN: use-after-free in iowarrior_disconnect (fix by Johan Hovold)

  127. KMSAN: use-after-free in mutex_spin_on_owner (fix by Johan Hovold)

  128. KMSAN: use-after-free in adu_disconnect (fix by Johan Hovold)

  129. KMSAN: kernel-usb-infoleak in pcan_usb_wait_rsp (fix by Johan Hovold)

  130. KMSAN: uninit-value in cdc_ncm_set_dgram_size (fix by Oliver Neukum)

  131. KMSAN: uninit-value in get_min_max_with_quirks (fix by Takashi Iwai)

  132. KMSAN: use-after-free in build_audio_procunit (fix by Takashi Iwai)

  133. KMSAN: uninit-value in aesti_encrypt (fix by Jakub Kicinski)

  134. KMSAN: uninit-value in gf128mul_4k_lle (3) (fix by Jakub Kicinski)

  135. KMSAN: uninit-value in ax88172a_bind (fix by Oliver Neukum)

  136. KMSAN: use-after-free in copyout (fix by Tomas Bortoli)

  137. KMSAN: use-after-free in skb_dequeue (fix by Tomas Bortoli)

  138. KMSAN: use-after-free in __netif_receive_skb_core (fix by Tomas Bortoli)

  139. KMSAN: use-after-free in sk_forced_mem_schedule (fix by Tomas Bortoli)

  140. KMSAN: use-after-free in __skb_try_recv_from_queue (fix by Tomas Bortoli)

  141. KMSAN: use-after-free in kfree_skb (fix by Tomas Bortoli)

  142. KMSAN: use-after-free in netlink_recvmsg (fix by Tomas Bortoli)

  143. KMSAN: uninit-value in nf_conntrack_tcp_packet (fix by Eric Dumazet)

  144. KMSAN: uninit-value in usbnet_probe (fix by Phong Tran)

  145. KMSAN: uninit-value in __request_module (2) (fix by Eric Dumazet)

Last update: 16.01.2020

Clone this wiki locally