Description
In the Linux kernel, the following vulnerability has been resolved: net: dsa: sja1105: fix kasan out-of-bounds warning in sja1105_table_delete_entry() There are actually 2 problems: - deleting the last element doesn't require the memmove of elements [i + 1, end) over it. Actually, element i+1 is out of bounds. - The memmove itself should move size - i - 1 elements, because the last element is out of bounds. The out-of-bounds element still remains out of bounds after being accessed, so the problem is only that we touch it, not that it becomes in active use. But I suppose it can lead to issues if the out-of-bounds element is part of an unmapped page.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
6666cebc5e306f49a25bd20aa8c1cb8ef8950df5 to < f85b9bfb08ba2b642d1810c6c4ae1e7b46f1776aaffected6666cebc5e306f49a25bd20aa8c1cb8ef8950df5 to < f117d0467215d7f1d445ae16d2c799637e63dc6caffected6666cebc5e306f49a25bd20aa8c1cb8ef8950df5 to < b52153da1f42e2f4d6259257a7ba027331671a93affected6666cebc5e306f49a25bd20aa8c1cb8ef8950df5 to < 4584486cfcca24b7b586da3377eb3cffd48669ecaffected6666cebc5e306f49a25bd20aa8c1cb8ef8950df5 to < 031e00249e9e6bee72ba66701c8f83b45fc4b8a2affected6666cebc5e306f49a25bd20aa8c1cb8ef8950df5 to < 59b97641de03c081f26b3a8876628c765b5faa25affected6666cebc5e306f49a25bd20aa8c1cb8ef8950df5 to < 5f2b28b79d2d1946ee36ad8b3dc0066f73c90481affected
Linux Linux
Default version status: affected
5.2affected0 to < 5.2unaffected5.10.258 to ≤ 5.10.*unaffected5.15.209 to ≤ 5.15.*unaffected6.1.160 to ≤ 6.1.*unaffected6.6.120 to ≤ 6.6.*unaffected6.12.59 to ≤ 6.12.*unaffected6.14.2 to ≤ 6.14.*unaffected6.15 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/f85b9bfb08ba2b642d1810c6c4ae1e7b46f1776a ↗
- https://git.kernel.org/stable/c/f117d0467215d7f1d445ae16d2c799637e63dc6c ↗
- https://git.kernel.org/stable/c/b52153da1f42e2f4d6259257a7ba027331671a93 ↗
- https://git.kernel.org/stable/c/4584486cfcca24b7b586da3377eb3cffd48669ec ↗
- https://git.kernel.org/stable/c/031e00249e9e6bee72ba66701c8f83b45fc4b8a2 ↗
- https://git.kernel.org/stable/c/59b97641de03c081f26b3a8876628c765b5faa25 ↗
- https://git.kernel.org/stable/c/5f2b28b79d2d1946ee36ad8b3dc0066f73c90481 ↗
- https://cert-portal.siemens.com/productcert/html/ssa-019113.html ↗
- https://cert-portal.siemens.com/productcert/html/ssa-457936.html ↗