Description
In the Linux kernel, the following vulnerability has been resolved: netfilter: ctnetlink: use netlink policy range checks Replace manual range and mask validations with netlink policy annotations in ctnetlink code paths, so that the netlink core rejects invalid values early and can generate extack errors. - CTA_PROTOINFO_TCP_STATE: reject values > TCP_CONNTRACK_SYN_SENT2 at policy level, removing the manual >= TCP_CONNTRACK_MAX check. - CTA_PROTOINFO_TCP_WSCALE_ORIGINAL/REPLY: reject values > TCP_MAX_WSCALE (14). The normal TCP option parsing path already clamps to this value, but the ctnetlink path accepted 0-255, causing undefined behavior when used as a u32 shift count. - CTA_FILTER_ORIG_FLAGS/REPLY_FLAGS: use NLA_POLICY_MASK with CTA_FILTER_F_ALL, removing the manual mask checks. - CTA_EXPECT_FLAGS: use NLA_POLICY_MASK with NF_CT_EXPECT_MASK, adding a new mask define grouping all valid expect flags. Extracted from a broader nf-next patch by Florian Westphal, scoped to ctnetlink for the fixes tree.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
c8e2078cfe414a99cf6f2f2f1d78c7e75392e9d4 to < 435b576cd2faa75154777868f8cbb73bf71644d3affectedc8e2078cfe414a99cf6f2f2f1d78c7e75392e9d4 to < 2ef71307c86a9f866d6e28f1a0c06e2e9d794474affectedc8e2078cfe414a99cf6f2f2f1d78c7e75392e9d4 to < 4f7d25f3f0786402ba48ff7d13b6241d77d975f5affectedc8e2078cfe414a99cf6f2f2f1d78c7e75392e9d4 to < fcec5ce2d73a41668b24e3f18c803541602a59f6affectedc8e2078cfe414a99cf6f2f2f1d78c7e75392e9d4 to < 675c913b940488a84effdeeac5a1cfb657b59804affectedc8e2078cfe414a99cf6f2f2f1d78c7e75392e9d4 to < c6cb41eaae875501eaaa487b8db6539feb092292affectedc8e2078cfe414a99cf6f2f2f1d78c7e75392e9d4 to < 45c33e79ae705b7af97e3117672b6cd258dd0b1baffectedc8e2078cfe414a99cf6f2f2f1d78c7e75392e9d4 to < 8f15b5071b4548b0aafc03b366eb45c9c6566704affected
Linux Linux
Default version status: affected
2.6.22affected0 to < 2.6.22unaffected5.10.253 to ≤ 5.10.*unaffected5.15.203 to ≤ 5.15.*unaffected6.1.168 to ≤ 6.1.*unaffected6.6.131 to ≤ 6.6.*unaffected6.12.80 to ≤ 6.12.*unaffected6.18.21 to ≤ 6.18.*unaffected6.19.11 to ≤ 6.19.*unaffected7.0 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/435b576cd2faa75154777868f8cbb73bf71644d3 ↗
- https://git.kernel.org/stable/c/2ef71307c86a9f866d6e28f1a0c06e2e9d794474 ↗
- https://git.kernel.org/stable/c/4f7d25f3f0786402ba48ff7d13b6241d77d975f5 ↗
- https://git.kernel.org/stable/c/fcec5ce2d73a41668b24e3f18c803541602a59f6 ↗
- https://git.kernel.org/stable/c/675c913b940488a84effdeeac5a1cfb657b59804 ↗
- https://git.kernel.org/stable/c/c6cb41eaae875501eaaa487b8db6539feb092292 ↗
- https://git.kernel.org/stable/c/45c33e79ae705b7af97e3117672b6cd258dd0b1b ↗
- https://git.kernel.org/stable/c/8f15b5071b4548b0aafc03b366eb45c9c6566704 ↗
- https://cert-portal.siemens.com/productcert/html/ssa-082556.html ↗
- https://cert-portal.siemens.com/productcert/html/ssa-019113.html ↗
- https://cert-portal.siemens.com/productcert/html/ssa-457936.html ↗