Linux Kernel KMSAN-Detected Information Leak Vulnerability in Netlink Message Handling

A vulnerability allowing a kernel information leak has been identified in the Linux kernel's networking component, specifically within the 'act_ife' scheduling actions. This issue arises from the 'opt' variable in the 'tcf_ife_dump()' function, which was only partially initialized. The uninitialized padding bytes were inadvertently leaked to userspace via a netlink message. The vulnerability affects several versions of the Linux kernel.

Impact

The vulnerability could lead to unintended information disclosure from kernel memory to userspace, potentially exposing sensitive data.

Reproduction

The vulnerability can be reproduced by sending a netlink message that includes the 'tc_ife' structure. The 'opt' variable will leak uninitialized bytes, which can be read by the user space application handling the netlink message.

Remediation

Users can upgrade to the latest version of the Linux kernel where this vulnerability has been fixed. Instructions for downloading the patched version are available on the official Linux kernel website.