Description
In the Linux kernel, the following vulnerability has been resolved: net: strparser: fix skb_head leak in strp_abort_strp() When the stream parser is aborted, for example after a message assembly timeout, it can still hold a reference to a partially assembled message in strp->skb_head. That skb is not released in strp_abort_strp(), which leaks the partially assembled message and can be triggered repeatedly to exhaust memory. Fix this by freeing strp->skb_head and resetting the parser state in the abort path. Leave strp_stop() unchanged so final cleanup still happens in strp_done() after the work and timer have been synchronized.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
43a0c6751a322847cb6fa0ab8cbf77a1d08bfc0a to < d6668ce0e78d23eabecef9a6bc4f0f739cb28ad3affected43a0c6751a322847cb6fa0ab8cbf77a1d08bfc0a to < a470ed71c906cc8cbad0d74c9942216698911f8baffected43a0c6751a322847cb6fa0ab8cbf77a1d08bfc0a to < c2e57695ec9ff9d42f23de70f3805199153d007baffected43a0c6751a322847cb6fa0ab8cbf77a1d08bfc0a to < e9ae00490d474757c0f9c65073de83e6bb1e5a00affected43a0c6751a322847cb6fa0ab8cbf77a1d08bfc0a to < 5327dad2ffe9c1b49881dd6d51ff3c6893847568affected43a0c6751a322847cb6fa0ab8cbf77a1d08bfc0a to < 19ca9475f18f991735f98a22e735c43e95e6298daffected43a0c6751a322847cb6fa0ab8cbf77a1d08bfc0a to < 56082f442023db9be1a5a29d4ee361de4017c0b7affected43a0c6751a322847cb6fa0ab8cbf77a1d08bfc0a to < fe72340daaf1af588be88056faf98965f39e6032affected
Linux Linux
Default version status: affected
4.9affected0 to < 4.9unaffected5.10.258 to ≤ 5.10.*unaffected5.15.209 to ≤ 5.15.*unaffected6.1.175 to ≤ 6.1.*unaffected6.6.140 to ≤ 6.6.*unaffected6.12.86 to ≤ 6.12.*unaffected6.18.27 to ≤ 6.18.*unaffected7.0.4 to ≤ 7.0.*unaffected7.1 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/d6668ce0e78d23eabecef9a6bc4f0f739cb28ad3 ↗
- https://git.kernel.org/stable/c/a470ed71c906cc8cbad0d74c9942216698911f8b ↗
- https://git.kernel.org/stable/c/c2e57695ec9ff9d42f23de70f3805199153d007b ↗
- https://git.kernel.org/stable/c/e9ae00490d474757c0f9c65073de83e6bb1e5a00 ↗
- https://git.kernel.org/stable/c/5327dad2ffe9c1b49881dd6d51ff3c6893847568 ↗
- https://git.kernel.org/stable/c/19ca9475f18f991735f98a22e735c43e95e6298d ↗
- https://git.kernel.org/stable/c/56082f442023db9be1a5a29d4ee361de4017c0b7 ↗
- https://git.kernel.org/stable/c/fe72340daaf1af588be88056faf98965f39e6032 ↗
- https://cert-portal.siemens.com/productcert/html/ssa-784472.html ↗