>= linux-4.4.0-130: 14 bytes memory leaked when sending AF_PACKET / SOCK_RAW frames

[Frank de Brabander]

Vulnerable: linux-image-4.4.0-130-generic, linux-image-4.4.0-131-generic
Not vulnerable: linux-image-4.4.0-128-generic

Bug (likely) introduced by commit:
https://github.com/torvalds/linux/commit/b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba

Likely fixed upstream with (NOT VERIFIED):
https://github.com/torvalds/linux/commit/9aad13b087ab0a588cd68259de618f100053360e

Discussion about these commits on maillist, including someone referring to this bug:
https://www.mail-archive.com/search?<email address hidden>&q=subject:%22Re%5C%3A+%5C%5BPATCH+net%5C%5D+packet%5C%3A+in+packet_snd+start+writing+at+link+layer+allocation%22&o=newest&f=1

When sending packets with AF_PACKET / SOCK_RAW, the actual transmitted packet contains 14 additional bytes at the end of the payload. Observations do show non-zero bytes getting leaked.

See attached source for a simple proof of concept that sends a raw packet on the loopback interface. The payload should be 40 bytes of 0xAA, but tcpdump clearly shows 14 additional bytes are added.

[Joseph Salisbury (jsalisbury)]

The fix to this bug is in Xenial master-next as the following commit:
6b15c1a packet: fix reserve calculation

It was applied to Xenial via the 4.4.137 upstream stable updates.