Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2024-26752

l2tp: pass correct message length to ip6_append_data

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: l2tp: pass correct message length to ip6_append_data l2tp_ip6_sendmsg needs to avoid accounting for the transport header twice when splicing more data into an already partially-occupied skbuff. To manage this, we check whether the skbuff contains data using skb_queue_empty when deciding how much data to append using ip6_append_data. However, the code which performed the calculation was incorrect: ulen = len + skb_queue_empty(&sk->sk_write_queue) ? transhdrlen : 0; ...due to C operator precedence, this ends up setting ulen to transhdrlen for messages with a non-zero length, which results in corrupted packets on the wire. Add parentheses to correct the calculation in line with the original intent.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 559d697c5d072593d22b3e0bd8b8081108aeaf59 to < 4c3ce64bc9d36ca9164dd6c77ff144c121011aaeaffected
  • 1fc793d68d50dee4782ef2e808913d5dd880bcc6 to < c1d3a84a67db910ce28a871273c992c3d7f9efb5affected
  • 96b2e1090397217839fcd6c9b6d8f5d439e705ed to < dcb4d14268595065c85dc5528056713928e17243affected
  • cd1189956393bf850b2e275e37411855d3bd86bb to < 0da15a70395182ee8cb75716baf00dddc0bea38daffected
  • f6a7182179c0ed788e3755ee2ed18c888ddcc33f to < 13cd1daeea848614e585b2c6ecc11ca9c8ab2500affected
  • 9d4c75800f61e5d75c1659ba201b6c0c7ead3070 to < 804bd8650a3a2bf3432375f8c97d5049d845ce56affected
  • 9d4c75800f61e5d75c1659ba201b6c0c7ead3070 to < 83340c66b498e49353530e41542500fc8a4782d6affected
  • 9d4c75800f61e5d75c1659ba201b6c0c7ead3070 to < 359e54a93ab43d32ee1bff3c2f9f10cb9f6b6e79affected
  • 7626b9fed53092aa2147978070e610ecb61af844affected
  • fe80658c08e3001c80c5533cd41abfbb0e0e28fdaffected
  • 4.19.296 to < 4.19.308affected
  • 5.4.258 to < 5.4.270affected
  • 5.10.198 to < 5.10.211affected
  • 5.15.135 to < 5.15.150affected
  • 6.1.57 to < 6.1.80affected
  • 4.14.327 to < 4.15affected
  • 6.5.7 to < 6.6affected

Linux Linux

Default version status: affected

  • 6.6affected
  • 0 to < 6.6unaffected
  • 4.19.308 to ≤ 4.19.*unaffected
  • 5.4.270 to ≤ 5.4.*unaffected
  • 5.10.211 to ≤ 5.10.*unaffected
  • 5.15.150 to ≤ 5.15.*unaffected
  • 6.1.80 to ≤ 6.1.*unaffected
  • 6.6.19 to ≤ 6.6.*unaffected
  • 6.7.7 to ≤ 6.7.*unaffected
  • 6.8 to ≤ *unaffected

References