Description
In the Linux kernel, the following vulnerability has been resolved: xfrm: validate new SA's prefixlen using SA family when sel.family is unset This expands the validation introduced in commit 07bf7908950a ("xfrm: Validate address prefix lengths in the xfrm selector.") syzbot created an SA with usersa.sel.family = AF_UNSPEC usersa.sel.prefixlen_s = 128 usersa.family = AF_INET Because of the AF_UNSPEC selector, verify_newsa_info doesn't put limits on prefixlen_{s,d}. But then copy_from_user_state sets x->sel.family to usersa.family (AF_INET). Do the same conversion in verify_newsa_info before validating prefixlen_{s,d}, since that's how prefixlen is going to be used later on.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < f31398570acf0f0804c644006f7bfa9067106b0aaffected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 401ad99a5ae7180dd9449eac104cb755f442e7f3affected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 8df5cd51fd70c33aa1776e5cbcd82b0a86649d73affected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 2d08a6c31c65f23db71a5385ee9cf9d8f9a67a71affected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < bce1afaa212ec380bf971614f70909a27882b862affected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 7d9868180bd1e4cf37e7c5067362658971162366affected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < e68dd80ba498265d2266b12dc3459164f4ff0c4aaffected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 3f0ab59e6537c6a8f9e1b355b48f9c05a76e8563affected
Linux Linux
Default version status: affected
2.6.12affected0 to < 2.6.12unaffected4.19.323 to ≤ 4.19.*unaffected5.4.285 to ≤ 5.4.*unaffected5.10.229 to ≤ 5.10.*unaffected5.15.170 to ≤ 5.15.*unaffected6.1.115 to ≤ 6.1.*unaffected6.6.59 to ≤ 6.6.*unaffected6.11.6 to ≤ 6.11.*unaffected6.12 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/f31398570acf0f0804c644006f7bfa9067106b0a ↗
- https://git.kernel.org/stable/c/401ad99a5ae7180dd9449eac104cb755f442e7f3 ↗
- https://git.kernel.org/stable/c/8df5cd51fd70c33aa1776e5cbcd82b0a86649d73 ↗
- https://git.kernel.org/stable/c/2d08a6c31c65f23db71a5385ee9cf9d8f9a67a71 ↗
- https://git.kernel.org/stable/c/bce1afaa212ec380bf971614f70909a27882b862 ↗
- https://git.kernel.org/stable/c/7d9868180bd1e4cf37e7c5067362658971162366 ↗
- https://git.kernel.org/stable/c/e68dd80ba498265d2266b12dc3459164f4ff0c4a ↗
- https://git.kernel.org/stable/c/3f0ab59e6537c6a8f9e1b355b48f9c05a76e8563 ↗
- https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html ↗
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html ↗
- https://cert-portal.siemens.com/productcert/html/ssa-265688.html ↗