Description
In the Linux kernel, the following vulnerability has been resolved: ipv4: prevent potential spectre v1 gadget in ip_metrics_convert() if (!type) continue; if (type > RTAX_MAX) return -EINVAL; ... metrics[type - 1] = val; @type being used as an array index, we need to prevent cpu speculation or risk leaking kernel memory content.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
6cf9dfd3bd62edfff69f11c0f111bc261166e4c7 to < ef050cf5fb70d995a0d03244e25179b7c66a924aaffected6cf9dfd3bd62edfff69f11c0f111bc261166e4c7 to < 746db9ec1e672eee13965625ddac0d97e16fa20caffected6cf9dfd3bd62edfff69f11c0f111bc261166e4c7 to < 34c6142f0df9cd75cba5a7aa9df0960d2854b415affected6cf9dfd3bd62edfff69f11c0f111bc261166e4c7 to < d50e7348b44f1e046121ff5be01b7fb6978a1149affected6cf9dfd3bd62edfff69f11c0f111bc261166e4c7 to < 6850fe301d015a7d2012d1de8caf43dafb7cc2f6affected6cf9dfd3bd62edfff69f11c0f111bc261166e4c7 to < 1d1d63b612801b3f0a39b7d4467cad0abd60e5c8affected
Linux Linux
Default version status: affected
4.3affected0 to < 4.3unaffected4.19.272 to ≤ 4.19.*unaffected5.4.231 to ≤ 5.4.*unaffected5.10.166 to ≤ 5.10.*unaffected5.15.91 to ≤ 5.15.*unaffected6.1.9 to ≤ 6.1.*unaffected6.2 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/ef050cf5fb70d995a0d03244e25179b7c66a924a ↗
- https://git.kernel.org/stable/c/746db9ec1e672eee13965625ddac0d97e16fa20c ↗
- https://git.kernel.org/stable/c/34c6142f0df9cd75cba5a7aa9df0960d2854b415 ↗
- https://git.kernel.org/stable/c/d50e7348b44f1e046121ff5be01b7fb6978a1149 ↗
- https://git.kernel.org/stable/c/6850fe301d015a7d2012d1de8caf43dafb7cc2f6 ↗
- https://git.kernel.org/stable/c/1d1d63b612801b3f0a39b7d4467cad0abd60e5c8 ↗