Description
In the Linux kernel, the following vulnerability has been resolved: net: sched: act_csum: validate nested VLAN headers tcf_csum_act() walks nested VLAN headers directly from skb->data when an skb still carries in-payload VLAN tags. The current code reads vlan->h_vlan_encapsulated_proto and then pulls VLAN_HLEN bytes without first ensuring that the full VLAN header is present in the linear area. If only part of an inner VLAN header is linearized, accessing h_vlan_encapsulated_proto reads past the linear area, and the following skb_pull(VLAN_HLEN) may violate skb invariants. Fix this by requiring pskb_may_pull(skb, VLAN_HLEN) before accessing and pulling each nested VLAN header. If the header still is not fully available, drop the packet through the existing error path.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
2ecba2d1e45b24620a7c3df9531895cf68d5dec6 to < 0410c619e86551677fb79887a38eccad3f5a0725affected2ecba2d1e45b24620a7c3df9531895cf68d5dec6 to < 886469b6455611a511aa6013e957e15e50577513affected2ecba2d1e45b24620a7c3df9531895cf68d5dec6 to < 46c07ad50fa2f4ba7663ee1b72b75ad7ad45cf09affected2ecba2d1e45b24620a7c3df9531895cf68d5dec6 to < eb3765b90eb8f2a3d6310a80c14a9e57ec4267a2affected2ecba2d1e45b24620a7c3df9531895cf68d5dec6 to < a69738efea0996d05a3c7d2178551b891744df1baffected2ecba2d1e45b24620a7c3df9531895cf68d5dec6 to < ec4930979b3f7bbeb7af5744599fc6603a4dba62affected2ecba2d1e45b24620a7c3df9531895cf68d5dec6 to < 3d165d975305cf76ff0b10a3c798fb31e5f5f9a5affected2ecba2d1e45b24620a7c3df9531895cf68d5dec6 to < c842743d073bdd683606cb414eb0ca84465dd834affected3764bfae5056e95617b6ee074129297e11710886affected4.19.99 to < 4.20affected
Linux Linux
Default version status: affected
5.1affected0 to < 5.1unaffected5.10.258 to ≤ 5.10.*unaffected5.15.209 to ≤ 5.15.*unaffected6.1.175 to ≤ 6.1.*unaffected6.6.136 to ≤ 6.6.*unaffected6.12.83 to ≤ 6.12.*unaffected6.18.24 to ≤ 6.18.*unaffected6.19.14 to ≤ 6.19.*unaffected7.0 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/0410c619e86551677fb79887a38eccad3f5a0725 ↗
- https://git.kernel.org/stable/c/886469b6455611a511aa6013e957e15e50577513 ↗
- https://git.kernel.org/stable/c/46c07ad50fa2f4ba7663ee1b72b75ad7ad45cf09 ↗
- https://git.kernel.org/stable/c/eb3765b90eb8f2a3d6310a80c14a9e57ec4267a2 ↗
- https://git.kernel.org/stable/c/a69738efea0996d05a3c7d2178551b891744df1b ↗
- https://git.kernel.org/stable/c/ec4930979b3f7bbeb7af5744599fc6603a4dba62 ↗
- https://git.kernel.org/stable/c/3d165d975305cf76ff0b10a3c798fb31e5f5f9a5 ↗
- https://git.kernel.org/stable/c/c842743d073bdd683606cb414eb0ca84465dd834 ↗