Description

In the Linux kernel, the following vulnerability has been resolved: net: mctp: ensure our nlmsg responses are initialised Syed Faraz Abrar (@farazsth98) from Zellic, and Pumpkin (@u1f383) from DEVCORE Research Team working with Trend Micro Zero Day Initiative report that a RTM_GETNEIGH will return uninitalised data in the pad bytes of the ndmsg data. Ensure we're initialising the netlink data to zero, in the link, addr and neigh response messages.

References 7

• git.kernel.org https://git.kernel.org/stable/c/54ed418de62a148a655262da682a050fa05f7924
• git.kernel.org https://git.kernel.org/stable/c/6fb6a97c86abb8592158088afaea0eb464cf9de1
• git.kernel.org https://git.kernel.org/stable/c/963537a26fd892f7e414a091f807b44aeee97a7d
• git.kernel.org https://git.kernel.org/stable/c/976612471a9e6ead6ceffc241e4d0a1aac90b36a
• git.kernel.org https://git.kernel.org/stable/c/a6a9bc544b675d8b5180f2718ec985ad267b5cbf
• git.kernel.org https://git.kernel.org/stable/c/b37da3ac099e145bcd3be82c745a8d335772e3af
• git.kernel.org https://git.kernel.org/stable/c/c4f840437e7641764de15f2de951ac8335d641f1

Remediation