Description
In the Linux kernel, the following vulnerability has been resolved: rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation Each attribute inside a nested IFLA_VF_VLAN_LIST is assumed to be a struct ifla_vf_vlan_info so the size of such attribute needs to be at least of sizeof(struct ifla_vf_vlan_info) which is 14 bytes. The current size validation in do_setvfinfo is against NLA_HDRLEN (4 bytes) which is less than sizeof(struct ifla_vf_vlan_info) so this validation is not enough and a too small attribute might be cast to a struct ifla_vf_vlan_info, this might result in an out of bands read access when accessing the saved (casted) entry in ivvl.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
79aab093a0b5370d7fc4e99df75996f4744dc03f to < 8ac69ff2d0d5be9734c4402de932aa3dc8549c1aaffected79aab093a0b5370d7fc4e99df75996f4744dc03f to < 5e7ef2d88666a0212db8c38e6703864b9ce70169affected79aab093a0b5370d7fc4e99df75996f4744dc03f to < 6c8f44b02500c7d14b5e6618fe4ef9a0da47b3deaffected79aab093a0b5370d7fc4e99df75996f4744dc03f to < f3c1bf3054f96ddeab0621d920445bada769b40eaffected79aab093a0b5370d7fc4e99df75996f4744dc03f to < 6e4c7193954f4faab92f6e8d88bc5565317b44e7affected79aab093a0b5370d7fc4e99df75996f4744dc03f to < 206003c748b88890a910ef7142d18f77be57550baffected79aab093a0b5370d7fc4e99df75996f4744dc03f to < 4a4b9757789a1551d2df130df23bfb3545bfa7e8affected79aab093a0b5370d7fc4e99df75996f4744dc03f to < 1aec77b2bb2ed1db0f5efc61c4c1ca3813307489affected
Linux Linux
Default version status: affected
4.9affected0 to < 4.9unaffected4.19.314 to ≤ 4.19.*unaffected5.4.276 to ≤ 5.4.*unaffected5.10.217 to ≤ 5.10.*unaffected5.15.159 to ≤ 5.15.*unaffected6.1.91 to ≤ 6.1.*unaffected6.6.31 to ≤ 6.6.*unaffected6.8.10 to ≤ 6.8.*unaffected6.9 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/8ac69ff2d0d5be9734c4402de932aa3dc8549c1a ↗
- https://git.kernel.org/stable/c/5e7ef2d88666a0212db8c38e6703864b9ce70169 ↗
- https://git.kernel.org/stable/c/6c8f44b02500c7d14b5e6618fe4ef9a0da47b3de ↗
- https://git.kernel.org/stable/c/f3c1bf3054f96ddeab0621d920445bada769b40e ↗
- https://git.kernel.org/stable/c/6e4c7193954f4faab92f6e8d88bc5565317b44e7 ↗
- https://git.kernel.org/stable/c/206003c748b88890a910ef7142d18f77be57550b ↗
- https://git.kernel.org/stable/c/4a4b9757789a1551d2df130df23bfb3545bfa7e8 ↗
- https://git.kernel.org/stable/c/1aec77b2bb2ed1db0f5efc61c4c1ca3813307489 ↗
- https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html ↗
- https://lists.debian.org/debian-lts-announce/2024/06/msg00019.html ↗
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html ↗
- https://cert-portal.siemens.com/productcert/html/ssa-613116.html ↗