KMSAN Trophies

Trophies

Bugs reported manually:

1. tmp.b_page uninitialized in generic_block_bmap()
   • Writeup: https://github.com/google/kmsan/blob/master/kmsan-first-bug-writeup.txt
   • Status: fixed upstream
2. strlen() called on non-terminated string in bind() for AF_PACKET
   • Status: fixed upstream
3. too short socket address passed to selinux_socket_bind()
   • Status: fixed upstream
4. uninitialized msg.msg_flags in recvfrom syscall
   • Status: fixed upstream
5. incorrect input length validation in nl_fib_input()
   • Status: fixed upstream by Eric Dumazet
6. uninitialized sockc.tsflags in udpv6_sendmsg()
   • Status: fixed upstream
7. incorrect input length validation in packet_getsockopt()
   • Status: fixed upstream
8. incorrect input length validation in raw_send_hdrinc() and rawv6_send_hdrinc()
   • Status: fixed upstream
9. missing check of nlmsg_parse() return value in rtnl_fdb_dump()
   • Status: fixed upstream
10. Linux kernel 2.6.0 to 4.12-rc4 infoleak due to a data race in ALSA timer (CVE-2017-1000380)
    • Status: fixed upstream (1, 2)
11. strlen() incorrectly called on user-supplied memory in dev_set_alias()
    • Status: fixed upstream
12. waitid() copies uninitialized data to userspace (CVE-2017-14954)
    • Status: fixed upstream by Al Viro
13. local infoleak via an SG_GET_REQUEST_TABLE ioctl call for /dev/sg0 (CVE-2017-14991)
    • Status: fixed upstream
14. Uninitialized TCP request hash used in cookie_v[46]_check()
    • Status: fixed upstream
15. _sctp_walk_params() and _sctp_walk_errors() dereference uninitialized pointers
    • Status: fixed upstream
16. sctp_v6_to_addr() compared addresses to uninit data
    • Status: fixed upstream
17. tun_get_user() accesses uninitialized data if skb->len is 0
    • Status: fixed upstream
18. sctp_inet6_skb_msgname() leaks 4 bytes to the userspace
    • Status: fixed upstream by Eric W. Biederman
19. Use of uninitialized memory in inet_ehash_insert()
    • Status: fixed upstream by Eric Dumazet
20. Buffer overflow in verify_address_len()
    • Status: fixed upstream by Eric Biggers
21. Insufficient validation of user provided tunnel names in vti6_tnl_create() (syzbot)
    • Status: fixed upstream by Eric Dumazet
22. Information disclosure in vhost/vhost.c:vhost_new_msg() (CVE-2018-1118)
    • Status: patch in flight

Confirmed bug reports by others:

1. deprecated_sysctl_warning() reads uninit memory
2. struct sockaddr length not checked in llcp_sock_connect()
3. uninitialized default host->id in nvmf_host_default()

Bugs reported by syzbot (see also https://syzkaller.appspot.com/upstream/fixed?manager=ci-upstream-kmsan-gce)

1. KMSAN: uninit-value in inet_csk_bind_conflict (fix by Eric Dumazet)

2. KMSAN: uninit-value in packet_set_ring (fix by Eric Dumazet)

3. KMSAN: uninit-value in neigh_dump_info (fix by Eric Dumazet)

4. KMSAN: uninit-value in iptable_mangle_hook (fix by Eric Dumazet)

5. KMSAN: uninit-value in pppoe_connect (fix by Guillaume Nault)

6. KMSAN: uninit-value in __skb_try_recv_from_queue (fix by Eric Dumazet)

7. KMSAN: uninit-value in memcmp (fix by Eric Dumazet) (duplicate)

8. KMSAN: uninit-value in fib_create_info (fix by Eric Dumazet)

9. KMSAN: uninit-value in netlink_sendmsg (fix by Eric Dumazet)

10. KMSAN: uninit-value in inet6_rtm_delroute (fix by Eric Dumazet)

11. KMSAN: uninit-value in fib6_new_table (fix by Eric Dumazet)

12. KMSAN: uninit-value in ip_route_output_key_hash_rcu (fix by Eric Dumazet)

13. KMSAN: uninit-value in sctp_sendmsg (fix by Eric Dumazet)

14. KMSAN: uninit-value in tcp_parse_options (fix by Eric Dumazet)

15. KMSAN: uninit-value in tipc_node_get_mtu (fix by Jon Maloy)

16. KMSAN: uninit-value in netif_skb_features (fix by Toshiaki Makita)

17. KMSAN: uninit-value in move_addr_to_user (fix by Eric Dumazet)

18. KMSAN: uninit-value in sctp_do_bind (fix by Eric Dumazet)

19. KMSAN: uninit-value in ip6table_mangle_hook (fix by Eric Dumazet)

20. KMSAN: uninit-value in pppol2tp_connect (fix by Guillaume Nault)

21. KMSAN: uninit-value in alg_bind (fix by Eric Dumazet)

22. KMSAN: uninit-value in inet_getpeer (fix by Eric Dumazet)

23. KMSAN: uninit-value in put_cmsg (fix by Eric Dumazet)

24. KMSAN: uninit-value in rt6_multipath_hash (fix by Eric Dumazet)

25. KMSAN: uninit-value in __sctp_v6_cmp_addr (fix by Xin Long)

26. KMSAN: uninit-value in move_addr_to_user (fix by Eric Dumazet)

27. KMSAN: uninit-value in strcmp (fix by Ying Xue)

28. KMSAN: uninit-value in ebt_stp_mt_check (fix by Stephen Hemminger)

29. KMSAN: uninit-value in ip_vs_lblc_check_expire (fix by Cong Wang)

30. KMSAN: uninit-value in rtnetlink_put_metrics (fix by Eric Dumazet)

31. KMSAN: uninit-value in eth_mac_addr (fix by Eric Dumazet)

32. KMSAN: uninit-value in ebt_stp_mt_check (fix by Florian Westphal)

33. KMSAN: uninit-value in nfqnl_recv_config (fix by Eric Dumazet)

34. KMSAN: uninit-value in ip_vs_lblcr_check_expire (fix by Cong Wang)

35. KMSAN: uninit-value in _copy_to_iter CVE-2018-1118 (fix by Kevin Easton)

36. KMSAN: kernel-infoleak in vcs_read (fix by Alexander Potapenko)

37. KMSAN: uninit-value in br_nf_forward_arp (fix by Willem de Bruijn)

38. KMSAN: uninit-value in ip_tunnel_xmit (fix by Willem de Bruijn)

39. KMSAN: uninit-value in af_alg_free_areq_sgls (fix by Stephan Mueller)

40. KMSAN: kernel-infoleak in _copy_to_iter (fix by Eric Dumazet) (duplicate)

41. KMSAN: uninit-value in gc_worker (fix by Florian Westphal)

42. KMSAN: kernel-infoleak in put_cmsg (fix by Willem de Bruijn)

43. KMSAN: uninit-value in __nf_conntrack_find_get (fix by Florian Westphal)

44. KMSAN: uninit-value in do_msgrcv (fix by Manfred Spraul)

45. KMSAN: uninit-value in snd_midi_event_encode_byte (fix by Takashi Iwai)

46. KMSAN: uninit-value in pppoe_rcv (fix by Guillaume Nault)

47. KMSAN: uninit-value in ip6_tnl_start_xmit (fix by Paolo Abeni)

48. KMSAN: kernel-infoleak in _copy_to_iter (fix by Jon Maloy)

49. KMSAN: uninit-value in vcs_read (fix by Alexander Potapenko)

50. KMSAN: uninit-value in ip_tunnel_lookup (fix by Jiri Benc)

51. KMSAN: uninit-value in dev_uc_add_excl (fix by Ido Schimmel)

52. KMSAN: uninit-value in dev_mc_add_excl (fix by Ido Schimmel)

53. KMSAN: uninit-value in synaptics_detect (fix by Dmitry Torokhov)

54. KMSAN: kernel-infoleak in kvm_arch_vcpu_ioctl (fix by Liran Alon)

55. KMSAN: kernel-infoleak in kvm_write_guest_page (fix by Liran Alon)

56. KMSAN: uninit-value in linear_transfer (fix by Takashi Iwai)

57. KMSAN: kernel-infoleak in _copy_to_iter (fix by Eric Dumazet)

58. KMSAN: uninit-value in packet_sendmsg (fix by Willem de Bruijn)

59. KMSAN: uninit-value in __inet6_bind (fix by Cong Wang)

60. KMSAN: kernel-infoleak in sctp_getsockopt (fix by Xin Long)

61. KMSAN: kernel-infoleak in capi_unlocked_ioctl (fix by Eric Dumazet)

62. KMSAN: uninit-value in check_6rd (fix by Willem de Bruijn)

63. KMSAN: uninit-value in vti6_tnl_xmit (fix by Willem de Bruijn)

64. KMSAN: uninit-value in gue6_err (fix by Eric Dumazet)

65. KMSAN: kernel-infoleak in sctp_getsockopt (2) (fix by Xin Long)

66. KMSAN: uninit-value in tipc_conn_rcv_sub (fix by Ying Xue)

67. KMSAN: uninit-value in gue_err (fix by Eric Dumazet)

68. KMSAN: uninit-value in tipc_nl_compat_dumpit (fix by Ying Xue)

69. KMSAN: kernel-infoleak in vmx_get_nested_state (fix by Tom Roeder)

70. KMSAN: uninit-value in kvm_clear_dirty_log_protect (fix by Tomas Bortoli)

71. KMSAN: uninit-value in tipc_nl_compat_link_reset_stats (fix by Ying Xue)

72. KMSAN: kernel-infoleak in move_addr_to_user (fix by Eric Dumazet)

73. KMSAN: uninit-value in tipc_nl_compat_bearer_enable (fix by Ying Xue)

74. KMSAN: uninit-value in tipc_nl_compat_link_set (2) (fix by Ying Xue)

75. KMSAN: uninit-value in tipc_nl_compat_name_table_dump (fix by Ying Xue)

76. KMSAN: uninit-value in tipc_nl_compat_doit (fix by Ying Xue)

77. KMSAN: kernel-infoleak in kvm_vcpu_write_guest_page (fix by Tom Roeder)

78. KMSAN: uninit-value in tipc_subscrb_rcv_cb (fix by Ying Xue)

79. KMSAN: uninit-value in batadv_interface_tx (fix by Eric Dumazet)

80. KMSAN: uninit-value in mpol_rebind_mm (fix by Vlastimil Babka)

81. KMSAN: kernel-infoleak in move_addr_to_user (2) (fix by Eric Dumazet)

82. KMSAN: uninit-value in gue_err (2) (fix by Eric Dumazet)

83. KMSAN: uninit-value in gue6_err (2) (fix by Eric Dumazet)

84. KMSAN: kernel-infoleak in video_usercopy (fix by Hans Verkuil)

85. KMSAN: uninit-value in mpol_rebind_mm (fix by Vlastimil Babka)

86. KMSAN: uninit-value in tipc_nl_compat_bearer_enable (2) (fix by Xin Long)

87. KMSAN: uninit-value in tipc_nl_compat_link_set (3) (fix by Xin Long)

88. KMSAN: kernel-infoleak in sctp_getsockopt (3) (fix by Xin Long)

89. KMSAN: uninit-value in tipc_nl_compat_name_table_dump (2) (fix by Xin Long)

90. KMSAN: uninit-value in ip6_compressed_string (fix by Tetsuo Handa)

91. KMSAN: uninit-value in tomoyo_check_unix_address (fix by Tetsuo Handa)

92. KMSAN: uninit-value in rtnl_stats_get (fix by Eric Dumazet)

93. KMSAN: uninit-value in rds_bind (fix by Tetsuo Handa)

94. KMSAN: uninit-value in tomoyo_check_inet_address (fix by Tetsuo Handa)

95. KMSAN: uninit-value in rtnl_stats_dump (fix by Eric Dumazet)

96. KMSAN: uninit-value in rds_connect (fix by Tetsuo Handa)

97. KMSAN: uninit-value in br_mdb_ip_get (fix by Nikolay Aleksandrov)

98. KMSAN: uninit-value in aa_fqlookupn_profile (fix by Zubin Mithra)

99. KMSAN: kernel-infoleak in copy_siginfo_to_user (2) (fix by Eric W. Biederman)

100. KMSAN: uninit-value in tcp_create_openreq_child (fix by Eric Dumazet)

101. KMSAN: uninit-value in tipc_nl_compat_bearer_disable (fix by Xin Long)

102. KMSAN: uninit-value in bond_start_xmit (2) (fix by Cong Wang)

103. KMSAN: uninit-value in ax88772_bind (fix by Phong Tran)

104. KMSAN: uninit-value in read_eprom_word (fix by Denis Kirjanov)

105. KMSAN: kernel-usb-infoleak in pcan_usb_pro_init (fix by Tomas Bortoli)

106. KMSAN: kernel-usb-infoleak in pcan_usb_pro_send_req (fix by Tomas Bortoli)

107. KMSAN: uninit-value in rtm_dump_nexthop (fix by David Ahern)

108. KMSAN: uninit-value in batadv_netlink_dump_hardif (fix by Eric Dumazet)

109. KMSAN: uninit-value in rtm_new_nexthop (fix by David Ahern)

110. KMSAN: uninit-value in batadv_iv_send_outstanding_bat_ogm_packet (fix by Sven Eckelmann)

111. KMSAN: uninit-value in capi_write (fix by Eric Biggers)

112. KMSAN: uninit-value in sd_init (fix by Hans Verkuil)

113. KMSAN: uninit-value in __request_module (fix by Cong Wang)

114. KMSAN: uninit-value in i2c_w (fix by Hans Verkuil)

115. KMSAN: uninit-value in inet_ehash_insert (fix by Eric Dumazet)

116. KMSAN: kernel-usb-infoleak in ttusb_dec_send_command (fix by Tomas Bortoli)

117. KMSAN: uninit-value in read_sensor_register (fix by Hans Verkuil)

118. KMSAN: uninit-value in iowarrior_disconnect (fix by Johan Hovold)

119. KMSAN: uninit-value in mts_usb_probe (fix by Johan Hovold)

120. KMSAN: uninit-value in sr9800_bind (fix by Valentin Vidic)

121. KMSAN: uninit-value in lg4ff_set_autocenter_default (fix by Alan Stern)

122. KMSAN: use-after-free in rxrpc_put_peer (fix by David Howells)

123. KMSAN: use-after-free in hidraw_ioctl (fix by Alan Stern)

124. KMSAN: use-after-free in __pm_runtime_resume

125. KMSAN: use-after-free in usb_autopm_put_interface (fix by Johan Hovold)

126. KMSAN: use-after-free in iowarrior_disconnect (fix by Johan Hovold)

127. KMSAN: use-after-free in mutex_spin_on_owner (fix by Johan Hovold)

128. KMSAN: use-after-free in adu_disconnect (fix by Johan Hovold)

129. KMSAN: kernel-usb-infoleak in pcan_usb_wait_rsp (fix by Johan Hovold)

130. KMSAN: uninit-value in cdc_ncm_set_dgram_size (fix by Oliver Neukum)

131. KMSAN: uninit-value in get_min_max_with_quirks (fix by Takashi Iwai)

132. KMSAN: use-after-free in build_audio_procunit (fix by Takashi Iwai)

133. KMSAN: uninit-value in aesti_encrypt (fix by Jakub Kicinski)

134. KMSAN: uninit-value in gf128mul_4k_lle (3) (fix by Jakub Kicinski)

135. KMSAN: uninit-value in ax88172a_bind (fix by Oliver Neukum)

136. KMSAN: use-after-free in copyout (fix by Tomas Bortoli)

137. KMSAN: use-after-free in skb_dequeue (fix by Tomas Bortoli)

138. KMSAN: use-after-free in __netif_receive_skb_core (fix by Tomas Bortoli)

139. KMSAN: use-after-free in sk_forced_mem_schedule (fix by Tomas Bortoli)

140. KMSAN: use-after-free in __skb_try_recv_from_queue (fix by Tomas Bortoli)

141. KMSAN: use-after-free in kfree_skb (fix by Tomas Bortoli)

142. KMSAN: use-after-free in netlink_recvmsg (fix by Tomas Bortoli)

143. KMSAN: uninit-value in nf_conntrack_tcp_packet (fix by Eric Dumazet)

144. KMSAN: uninit-value in usbnet_probe (fix by Phong Tran)

145. KMSAN: uninit-value in __request_module (2) (fix by Eric Dumazet)

Last update: 16.01.2020