Bug 1213251 (CVE-2023-3106) - VUL-0: CVE-2023-3106: kernel: netlink socket crash (null pointer deref) in netlink_dump function
Summary: VUL-0: CVE-2023-3106: kernel: netlink socket crash (null pointer deref) in ne...
Status: RESOLVED FIXED
Alias: CVE-2023-3106
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Normal
Target Milestone: ---
Assignee: Security Team bot
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/372135/
Whiteboard: CVSSv3.1:SUSE:CVE-2023-3106:6.6:(AV:L...
Keywords:
Depends on:
Blocks:
 
Reported: 2023-07-12 13:22 UTC by Robert Frohl
Modified: 2023-09-01 04:00 UTC (History)
4 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Robert Frohl 2023-07-12 13:22:10 UTC 
CVE-2023-3106

A NULL pointer dereference vulnerability was found in netlink_dump. This issue
can occur when the Netlink socket receives the message(sendmsg) for the
XFRM_MSG_GETSA, XFRM_MSG_GETPOLICY type message, and the DUMP flag is set and
can cause a denial of service or possibly another unspecified impact. Due to the
nature of the flaw, privilege escalation cannot be fully ruled out, although it
is unlikely.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-3106
https://bugzilla.redhat.com/show_bug.cgi?id=2221501
https://www.cve.org/CVERecord?id=CVE-2023-3106
https://access.redhat.com/security/cve/CVE-2023-3106
https://github.com/torvalds/linux/commit/1ba5bf993c6a3142e18e68ea6452b347f9cb5635
Comment 1 Chester Lin 2023-07-12 14:12:27 UTC 
Reassigning to a concrete person to ensure progress [1] (feel free to pass to next one), see also the process at [2].
 
Hi Michal, it's related to XFRM so could you please take a look at this CVE? Thanks.
 
[1] https://confluence.suse.com/display/KSS/Kernel+Security+Sentinel
[2] https://wiki.suse.net/index.php/SUSE-Labs/Kernel/Security
Comment 4 Michal Kubeček 2023-07-20 20:28:34 UTC 
introduced      d3623099d350    3.15-rc1
fixed           1ba5bf993c6a    4.8-rc7

The fix has been submitted to all relevant branches:

cve/linux-4.4   10b2ad1047cb

Reassigning back to security team.
Comment 9 Maintenance Automation 2023-08-16 08:31:36 UTC 
SUSE-SU-2023:3324-1: An update that solves 14 vulnerabilities and has two fixes can now be installed.

Category: security (important)
Bug References: 1087082, 1126703, 1206418, 1207561, 1209779, 1210584, 1211738, 1211867, 1212502, 1213059, 1213167, 1213251, 1213286, 1213287, 1213585, 1213588
CVE References: CVE-2018-20784, CVE-2018-3639, CVE-2022-40982, CVE-2023-0459, CVE-2023-1637, CVE-2023-20569, CVE-2023-20593, CVE-2023-2985, CVE-2023-3106, CVE-2023-3268, CVE-2023-35001, CVE-2023-3567, CVE-2023-3611, CVE-2023-3776
Sources used:
SUSE Linux Enterprise Server 12 SP2 BCL 12-SP2 (src): kernel-syms-4.4.121-92.208.1, kernel-source-4.4.121-92.208.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.