Description
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() In DecodeQ931(), the UserUserIE code path reads a 16-bit length from the packet, then decrements it by 1 to skip the protocol discriminator byte before passing it to DecodeH323_UserInformation(). If the encoded length is 0, the decrement wraps to -1, which is then passed as a large value to the decoder, leading to an out-of-bounds read. Add a check to ensure len is positive after the decrement.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
5e35941d990123f155b02d5663e51a24f816b6f3 to < 2121f5fbe88daff0f1fc5bc47d359426c74b86b0affected5e35941d990123f155b02d5663e51a24f816b6f3 to < 65fa92f79677858b14b9e4b7275f26639afe2710affected5e35941d990123f155b02d5663e51a24f816b6f3 to < 495e97af9e7249ee02b72bb1d0848a6efc3700f4affected5e35941d990123f155b02d5663e51a24f816b6f3 to < f5e4f4e4cdb75ec36802059a94195a31f193da60affected5e35941d990123f155b02d5663e51a24f816b6f3 to < 633e8f87dad32263f6a57dccdb873f042c062111affected5e35941d990123f155b02d5663e51a24f816b6f3 to < 9d00fe7d6d7c5b5f1065a6e042b54f2e44bd6df8affected5e35941d990123f155b02d5663e51a24f816b6f3 to < b652b05d51003ac074b912684f9ec7486231717baffected5e35941d990123f155b02d5663e51a24f816b6f3 to < f173d0f4c0f689173f8cdac79991043a4a89bf66affected
Linux Linux
Default version status: affected
2.6.17affected0 to < 2.6.17unaffected5.10.253 to ≤ 5.10.*unaffected5.15.203 to ≤ 5.15.*unaffected6.1.167 to ≤ 6.1.*unaffected6.6.130 to ≤ 6.6.*unaffected6.12.78 to ≤ 6.12.*unaffected6.18.20 to ≤ 6.18.*unaffected6.19.10 to ≤ 6.19.*unaffected7.0 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/2121f5fbe88daff0f1fc5bc47d359426c74b86b0 ↗
- https://git.kernel.org/stable/c/65fa92f79677858b14b9e4b7275f26639afe2710 ↗
- https://git.kernel.org/stable/c/495e97af9e7249ee02b72bb1d0848a6efc3700f4 ↗
- https://git.kernel.org/stable/c/f5e4f4e4cdb75ec36802059a94195a31f193da60 ↗
- https://git.kernel.org/stable/c/633e8f87dad32263f6a57dccdb873f042c062111 ↗
- https://git.kernel.org/stable/c/9d00fe7d6d7c5b5f1065a6e042b54f2e44bd6df8 ↗
- https://git.kernel.org/stable/c/b652b05d51003ac074b912684f9ec7486231717b ↗
- https://git.kernel.org/stable/c/f173d0f4c0f689173f8cdac79991043a4a89bf66 ↗
- https://cert-portal.siemens.com/productcert/html/ssa-082556.html ↗
- https://cert-portal.siemens.com/productcert/html/ssa-019113.html ↗
- https://cert-portal.siemens.com/productcert/html/ssa-457936.html ↗