Description
In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: add missing range check in bitmap_ip_uadt When tb[IPSET_ATTR_IP_TO] is not present but tb[IPSET_ATTR_CIDR] exists, the values of ip and ip_to are slightly swapped. Therefore, the range check for ip should be done later, but this part is missing and it seems that the vulnerability occurs. So we should add missing range checks and remove unnecessary range checks.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
72205fc68bd13109576aa6c4c12c740962d28a6c to < 3c20b5948f119ae61ee35ad8584d666020c91581affected72205fc68bd13109576aa6c4c12c740962d28a6c to < 78b0f2028f1043227a8eb0c41944027fc6a04596affected72205fc68bd13109576aa6c4c12c740962d28a6c to < 2e151b8ca31607d14fddc4ad0f14da0893e1a7c7affected72205fc68bd13109576aa6c4c12c740962d28a6c to < e67471437ae9083fa73fa67eee1573fec1b7c8cfaffected72205fc68bd13109576aa6c4c12c740962d28a6c to < 7ffef5e5d5eeecd9687204a5ec2d863752aafb7eaffected72205fc68bd13109576aa6c4c12c740962d28a6c to < 856023ef032d824309abd5c747241dffa33aae8caffected72205fc68bd13109576aa6c4c12c740962d28a6c to < 591efa494a1cf649f50a35def649c43ae984cd03affected72205fc68bd13109576aa6c4c12c740962d28a6c to < 15794835378ed56fb9bacc6a5dd3b9f33520604eaffected72205fc68bd13109576aa6c4c12c740962d28a6c to < 35f56c554eb1b56b77b3cf197a6b00922d49033daffected
Linux Linux
Default version status: affected
2.6.39affected0 to < 2.6.39unaffected4.19.325 to ≤ 4.19.*unaffected5.4.287 to ≤ 5.4.*unaffected5.10.231 to ≤ 5.10.*unaffected5.15.174 to ≤ 5.15.*unaffected6.1.120 to ≤ 6.1.*unaffected6.6.64 to ≤ 6.6.*unaffected6.11.11 to ≤ 6.11.*unaffected6.12.2 to ≤ 6.12.*unaffected6.13 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/3c20b5948f119ae61ee35ad8584d666020c91581 ↗
- https://git.kernel.org/stable/c/78b0f2028f1043227a8eb0c41944027fc6a04596 ↗
- https://git.kernel.org/stable/c/2e151b8ca31607d14fddc4ad0f14da0893e1a7c7 ↗
- https://git.kernel.org/stable/c/e67471437ae9083fa73fa67eee1573fec1b7c8cf ↗
- https://git.kernel.org/stable/c/7ffef5e5d5eeecd9687204a5ec2d863752aafb7e ↗
- https://git.kernel.org/stable/c/856023ef032d824309abd5c747241dffa33aae8c ↗
- https://git.kernel.org/stable/c/591efa494a1cf649f50a35def649c43ae984cd03 ↗
- https://git.kernel.org/stable/c/15794835378ed56fb9bacc6a5dd3b9f33520604e ↗
- https://git.kernel.org/stable/c/35f56c554eb1b56b77b3cf197a6b00922d49033d ↗
- https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html ↗
- https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html ↗