Description
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() sip_help_tcp() parses the SIP Content-Length header with simple_strtoul(), which returns unsigned long, but stores the result in unsigned int clen. On 64-bit systems, values exceeding UINT_MAX are silently truncated before computing the SIP message boundary. For example, Content-Length 4294967328 (2^32 + 32) is truncated to 32, causing the parser to miscalculate where the current message ends. The loop then treats trailing data in the TCP segment as a second SIP message and processes it through the SDP parser. Fix this by changing clen to unsigned long to match the return type of simple_strtoul(), and reject Content-Length values that exceed the remaining TCP payload length.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
f5b321bd37fbec9188feb1f721ab46a5ac0b35da to < ed81b6a7012485acdb9c6c80735a0b7d8e5e1873affectedf5b321bd37fbec9188feb1f721ab46a5ac0b35da to < cd1b7403ec835f8a0b3f1f7e68ac26af2cb1e42faffectedf5b321bd37fbec9188feb1f721ab46a5ac0b35da to < b75209debb9adab287b3caa982f77788c1e15027affectedf5b321bd37fbec9188feb1f721ab46a5ac0b35da to < 528b4509c9dfc272e2e92d811915e5211650d383affectedf5b321bd37fbec9188feb1f721ab46a5ac0b35da to < 75fcaee5170e7dbbee778927134ef2e9568b4659affectedf5b321bd37fbec9188feb1f721ab46a5ac0b35da to < 865dba58958c3a86786f89a501971ab0e3ec6ba9affectedf5b321bd37fbec9188feb1f721ab46a5ac0b35da to < d4f17256544cc37f6534a14a27a9dec3540c2015affectedf5b321bd37fbec9188feb1f721ab46a5ac0b35da to < fbce58e719a17aa215c724473fd5baaa4a8dc57caffected
Linux Linux
Default version status: affected
2.6.34affected0 to < 2.6.34unaffected5.10.253 to ≤ 5.10.*unaffected5.15.203 to ≤ 5.15.*unaffected6.1.167 to ≤ 6.1.*unaffected6.6.130 to ≤ 6.6.*unaffected6.12.78 to ≤ 6.12.*unaffected6.18.20 to ≤ 6.18.*unaffected6.19.10 to ≤ 6.19.*unaffected7.0 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/ed81b6a7012485acdb9c6c80735a0b7d8e5e1873 ↗
- https://git.kernel.org/stable/c/cd1b7403ec835f8a0b3f1f7e68ac26af2cb1e42f ↗
- https://git.kernel.org/stable/c/b75209debb9adab287b3caa982f77788c1e15027 ↗
- https://git.kernel.org/stable/c/528b4509c9dfc272e2e92d811915e5211650d383 ↗
- https://git.kernel.org/stable/c/75fcaee5170e7dbbee778927134ef2e9568b4659 ↗
- https://git.kernel.org/stable/c/865dba58958c3a86786f89a501971ab0e3ec6ba9 ↗
- https://git.kernel.org/stable/c/d4f17256544cc37f6534a14a27a9dec3540c2015 ↗
- https://git.kernel.org/stable/c/fbce58e719a17aa215c724473fd5baaa4a8dc57c ↗
- https://cert-portal.siemens.com/productcert/html/ssa-082556.html ↗
- https://cert-portal.siemens.com/productcert/html/ssa-019113.html ↗
- https://cert-portal.siemens.com/productcert/html/ssa-457936.html ↗