Description
In the Linux kernel, the following vulnerability has been resolved: batman-adv: fix fragment reassembly length accounting batman-adv keeps a running payload length for queued fragments and uses it to validate a fragment chain before reassembly. That accounting currently allows the accumulated fragment length to be truncated during updates. As a result, malformed fragment chains can bypass the intended validation and drive reassembly with inconsistent length state, leading to a local denial of service. Fix the accounting by storing the accumulated length in a length-typed field and rejecting update overflows before the existing validation logic runs. The fix was verified against the original reproducer and against valid fragment reassembly paths.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
610bfc6bc99bc83680d190ebc69359a05fc7f605 to < e4f3f6b818aa6a678bc54a2d4e0bece2303c6a64affected610bfc6bc99bc83680d190ebc69359a05fc7f605 to < 37be61825b15534a16ff9cfc9546de155b6df982affected610bfc6bc99bc83680d190ebc69359a05fc7f605 to < 975563c5de1123dde1ec7946bf5556d20c89d74eaffected610bfc6bc99bc83680d190ebc69359a05fc7f605 to < f653b040dad1af70fa5cd4fe085e4758925480c9affected610bfc6bc99bc83680d190ebc69359a05fc7f605 to < e910dbf509125fe51ad68e4fa74dc8ab0a8e787aaffected610bfc6bc99bc83680d190ebc69359a05fc7f605 to < 3eb8bcb823391bd58997831b3c9c152a4ba8e255affected610bfc6bc99bc83680d190ebc69359a05fc7f605 to < fdb2c96efb2baeb3725e9ce3ede8f1e36f5490f0affected610bfc6bc99bc83680d190ebc69359a05fc7f605 to < 9cd3f16c320bfdadd4509358122368deb56a5741affected
Linux Linux
Default version status: affected
3.13affected0 to < 3.13unaffected5.10.258 to ≤ 5.10.*unaffected5.15.209 to ≤ 5.15.*unaffected6.1.175 to ≤ 6.1.*unaffected6.6.142 to ≤ 6.6.*unaffected6.12.92 to ≤ 6.12.*unaffected6.18.34 to ≤ 6.18.*unaffected7.0.11 to ≤ 7.0.*unaffected7.1 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/e4f3f6b818aa6a678bc54a2d4e0bece2303c6a64 ↗
- https://git.kernel.org/stable/c/37be61825b15534a16ff9cfc9546de155b6df982 ↗
- https://git.kernel.org/stable/c/975563c5de1123dde1ec7946bf5556d20c89d74e ↗
- https://git.kernel.org/stable/c/f653b040dad1af70fa5cd4fe085e4758925480c9 ↗
- https://git.kernel.org/stable/c/e910dbf509125fe51ad68e4fa74dc8ab0a8e787a ↗
- https://git.kernel.org/stable/c/3eb8bcb823391bd58997831b3c9c152a4ba8e255 ↗
- https://git.kernel.org/stable/c/fdb2c96efb2baeb3725e9ce3ede8f1e36f5490f0 ↗
- https://git.kernel.org/stable/c/9cd3f16c320bfdadd4509358122368deb56a5741 ↗