Description
In the Linux kernel, the following vulnerability has been resolved: slip: bound decode() reads against the compressed packet length slhc_uncompress() parses a VJ-compressed TCP header by advancing a pointer through the packet via decode() and pull16(). Neither helper bounds-checks against isize, and decode() masks its return with & 0xffff so it can never return the -1 that callers test for -- those error paths are dead code. A short compressed frame whose change byte requests optional fields lets decode() read past the end of the packet. The over-read bytes are folded into the cached cstate and reflected into subsequent reconstructed packets. Make decode() and pull16() take the packet end pointer and return -1 when exhausted. Add a bounds check before the TCP-checksum read. The existing == -1 tests now do what they were always meant to.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 6268f01ae989013671b526c883e92655342c6f6faffected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 9aafba2f49e1fcccc2018816f5836a609c925879affected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 335957df4ed60f02a2ec0432fbedbf0cc7241d8baffected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 37537e42e6df387398bee85cb85070cc80bb1e10affected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 4cefe32639933d652614b0bd50f818f9af4af78faffected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 0511ecb00e61bf28e2fec4bb41fcce385c3a3b2daffected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < d42bec6e4f6d6d658be365539400b3314b76b2a7affected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 4c1367a2d7aad643a6f87c6931b13cc1a25e8ca7affected
Linux Linux
Default version status: affected
2.6.12affected0 to < 2.6.12unaffected5.10.258 to ≤ 5.10.*unaffected5.15.209 to ≤ 5.15.*unaffected6.1.175 to ≤ 6.1.*unaffected6.6.141 to ≤ 6.6.*unaffected6.12.91 to ≤ 6.12.*unaffected6.18.33 to ≤ 6.18.*unaffected7.0.10 to ≤ 7.0.*unaffected7.1 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/6268f01ae989013671b526c883e92655342c6f6f ↗
- https://git.kernel.org/stable/c/9aafba2f49e1fcccc2018816f5836a609c925879 ↗
- https://git.kernel.org/stable/c/335957df4ed60f02a2ec0432fbedbf0cc7241d8b ↗
- https://git.kernel.org/stable/c/37537e42e6df387398bee85cb85070cc80bb1e10 ↗
- https://git.kernel.org/stable/c/4cefe32639933d652614b0bd50f818f9af4af78f ↗
- https://git.kernel.org/stable/c/0511ecb00e61bf28e2fec4bb41fcce385c3a3b2d ↗
- https://git.kernel.org/stable/c/d42bec6e4f6d6d658be365539400b3314b76b2a7 ↗
- https://git.kernel.org/stable/c/4c1367a2d7aad643a6f87c6931b13cc1a25e8ca7 ↗
- https://cert-portal.siemens.com/productcert/html/ssa-784472.html ↗