Description
In the Linux kernel, the following vulnerability has been resolved: netlink: prevent potential spectre v1 gadgets Most netlink attributes are parsed and validated from __nla_validate_parse() or validate_nla() u16 type = nla_type(nla); if (type == 0 || type > maxtype) { /* error or continue */ } @type is then used as an array index and can be used as a Spectre v1 gadget. array_index_nospec() can be used to prevent leaking content of kernel memory to malicious users. This should take care of vast majority of netlink uses, but an audit is needed to take care of others where validation is not yet centralized in core netlink functions.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
bfa83a9e03cf8d501c6272999843470afecb32ed to < 3e5082b1c66c7783fbcd79b5b178573230e528ffaffectedbfa83a9e03cf8d501c6272999843470afecb32ed to < 539ca5dcbc91134bbe2c45677811c31d8b030d2daffectedbfa83a9e03cf8d501c6272999843470afecb32ed to < 41b74e95f297ac360ca7ed6bf200100717cb6c45affectedbfa83a9e03cf8d501c6272999843470afecb32ed to < 992e4ff7116a77968039277b5d6aaa535c2f2184affectedbfa83a9e03cf8d501c6272999843470afecb32ed to < f0950402e8c76e7dcb08563f1b4e8000fbc62455affected
Linux Linux
Default version status: affected
2.6.15affected0 to < 2.6.15unaffected5.4.231 to ≤ 5.4.*unaffected5.10.166 to ≤ 5.10.*unaffected5.15.91 to ≤ 5.15.*unaffected6.1.9 to ≤ 6.1.*unaffected6.2 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/3e5082b1c66c7783fbcd79b5b178573230e528ff ↗
- https://git.kernel.org/stable/c/539ca5dcbc91134bbe2c45677811c31d8b030d2d ↗
- https://git.kernel.org/stable/c/41b74e95f297ac360ca7ed6bf200100717cb6c45 ↗
- https://git.kernel.org/stable/c/992e4ff7116a77968039277b5d6aaa535c2f2184 ↗
- https://git.kernel.org/stable/c/f0950402e8c76e7dcb08563f1b4e8000fbc62455 ↗