Linux Kernel Information Leak Vulnerability in xfrm_user Report Building

A vulnerability in the Linux kernel's xfrm_user component can lead to an information leak. The issue arises because the xfrm_user_report structure includes a protocol field followed by a selector structure, creating three bytes of padding that are not zeroed before being copied to userspace. This oversight can result in uninitialized data being exposed. The vulnerability affects the Linux kernel stable tree.

Impact

The vulnerability can lead to an information leak, allowing uninitialized data to be exposed to userspace.

Reproduction

The vulnerability can be reproduced by sending a netlink message that includes the xfrm_user_report structure without the protocol field padding being zeroed. This can be done by manipulating the xfrm_user component to build a report that includes uninitialized data.

Remediation

Users can upgrade to the latest version of the Linux kernel stable tree, where this vulnerability has been addressed.