Description
In the Linux kernel, the following vulnerability has been resolved: mpls: add seqcount to protect the platform_label{,s} pair The RCU-protected codepaths (mpls_forward, mpls_dump_routes) can have an inconsistent view of platform_labels vs platform_label in case of a concurrent resize (resize_platform_label_table, under platform_mutex). This can lead to OOB accesses. This patch adds a seqcount, so that we get a consistent snapshot. Note that mpls_label_ok is also susceptible to this, so the check against RTA_DST in rtm_to_route_config, done outside platform_mutex, is not sufficient. This value gets passed to mpls_label_ok once more in both mpls_route_add and mpls_route_del, so there is no issue, but that additional check must not be removed.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
7720c01f3f590116882e251f13c7e1d5602f8643 to < 6b9184ebc936f791631e51e783ab30320b3770e4affected7720c01f3f590116882e251f13c7e1d5602f8643 to < 0d377825548fe598595b5a5fa4a309fb593d8fb4affected7720c01f3f590116882e251f13c7e1d5602f8643 to < 8adc5b6fc876928d8c95555d30b66fa50b07421eaffected7720c01f3f590116882e251f13c7e1d5602f8643 to < 5bb3caf0bbfb56f1a00d2af072ac3d8395a3b9efaffected7720c01f3f590116882e251f13c7e1d5602f8643 to < 629ec78ef8608d955ce217880cdc3e1873af3a15affected
Linux Linux
Default version status: affected
4.1affected0 to < 4.1unaffected6.1.191 to ≤ 6.1.*unaffected6.6.160 to ≤ 6.6.*unaffected6.12.114 to ≤ 6.12.*unaffected6.19.12 to ≤ 6.19.*unaffected7.0 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/6b9184ebc936f791631e51e783ab30320b3770e4 ↗
- https://git.kernel.org/stable/c/0d377825548fe598595b5a5fa4a309fb593d8fb4 ↗
- https://git.kernel.org/stable/c/8adc5b6fc876928d8c95555d30b66fa50b07421e ↗
- https://git.kernel.org/stable/c/5bb3caf0bbfb56f1a00d2af072ac3d8395a3b9ef ↗
- https://git.kernel.org/stable/c/629ec78ef8608d955ce217880cdc3e1873af3a15 ↗