Description
In the Linux kernel, the following vulnerability has been resolved: batman-adv: frag: disallow unicast fragment in fragment batadv_frag_skb_buffer() is called by batadv_batman_skb_recv() when a BATADV_UNICAST_FRAG packet is received. Once all fragments are collected and the packet is reassembled, batadv_recv_frag_packet() calls batadv_batman_skb_recv() again to process the defragmented payload. A malicious sender can craft a BATADV_UNICAST_FRAG packet whose reassembled payload is itself a BATADV_UNICAST_FRAG packet (matryoshka-style nesting). Each nesting level recurses through batadv_batman_skb_recv() without bound, growing the kernel stack until it is exhausted. Since refragmentation or fragments in fragments are not actually allowed, discard all packets which are still BATADV_UNICAST_FRAG packets after the defragmentation process.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
610bfc6bc99bc83680d190ebc69359a05fc7f605 to < 0c208fa3859e3a33a1c38bebc41d021166e94ac8affected610bfc6bc99bc83680d190ebc69359a05fc7f605 to < bcda4814dc6524283c0b958882cb963d75fe411daffected610bfc6bc99bc83680d190ebc69359a05fc7f605 to < aea54d0bbe156d5ab7d00d68f66149ff41f4612aaffected610bfc6bc99bc83680d190ebc69359a05fc7f605 to < b54e459cf86943583c1aa2ee3081874e7ab1f5f3affected610bfc6bc99bc83680d190ebc69359a05fc7f605 to < 5418be6c2e117bf8a316582795a8e3ff90f45e5daffected610bfc6bc99bc83680d190ebc69359a05fc7f605 to < 5895ad21c7059a652da83fb817510f7a1e962abfaffected610bfc6bc99bc83680d190ebc69359a05fc7f605 to < 7138c35c9ad39a2fca6264af6b87466471f04ffcaffected610bfc6bc99bc83680d190ebc69359a05fc7f605 to < bc62216dc8e221e3781afa14430f45208bfa9af9affected
Linux Linux
Default version status: affected
3.13affected0 to < 3.13unaffected5.10.258 to ≤ 5.10.*unaffected5.15.209 to ≤ 5.15.*unaffected6.1.175 to ≤ 6.1.*unaffected6.6.142 to ≤ 6.6.*unaffected6.12.92 to ≤ 6.12.*unaffected6.18.34 to ≤ 6.18.*unaffected7.0.11 to ≤ 7.0.*unaffected7.1 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/0c208fa3859e3a33a1c38bebc41d021166e94ac8 ↗
- https://git.kernel.org/stable/c/bcda4814dc6524283c0b958882cb963d75fe411d ↗
- https://git.kernel.org/stable/c/aea54d0bbe156d5ab7d00d68f66149ff41f4612a ↗
- https://git.kernel.org/stable/c/b54e459cf86943583c1aa2ee3081874e7ab1f5f3 ↗
- https://git.kernel.org/stable/c/5418be6c2e117bf8a316582795a8e3ff90f45e5d ↗
- https://git.kernel.org/stable/c/5895ad21c7059a652da83fb817510f7a1e962abf ↗
- https://git.kernel.org/stable/c/7138c35c9ad39a2fca6264af6b87466471f04ffc ↗
- https://git.kernel.org/stable/c/bc62216dc8e221e3781afa14430f45208bfa9af9 ↗