Description
In the Linux kernel, the following vulnerability has been resolved: netfilter: xt_policy: fix strict mode inbound policy matching match_policy_in() walks sec_path entries from the last transform to the first one, but strict policy matching needs to consume info->pol[] in the same forward order as the rule layout. Derive the strict-match policy position from the number of transforms already consumed so that multi-element inbound rules are matched consistently.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
c4b885139203d37f76662c37ae645fe8e0f4e4e5 to < eb323f7b82d2e2f638de0cc2a177803eb20e0707affectedc4b885139203d37f76662c37ae645fe8e0f4e4e5 to < fc1c518bb1f054831ecabb32da9b8e1dff9699c6affectedc4b885139203d37f76662c37ae645fe8e0f4e4e5 to < f98b7f85e04b40e28b08c461ded0cc79f14f5509affectedc4b885139203d37f76662c37ae645fe8e0f4e4e5 to < 82664d0f1ba25e4f9a71994954abae24c60f4067affectedc4b885139203d37f76662c37ae645fe8e0f4e4e5 to < b130a6eefa02bd4d475f2f059da8bcfb3e7d18d9affectedc4b885139203d37f76662c37ae645fe8e0f4e4e5 to < 938867e870fb5471bb16f442aeac81326e05bf65affectedc4b885139203d37f76662c37ae645fe8e0f4e4e5 to < 392cc1d8408b5665215c1e9290bbf0f92339b043affectedc4b885139203d37f76662c37ae645fe8e0f4e4e5 to < 4b2b4d7d4e203c92db8966b163edfacb1f0e1e29affected
Linux Linux
Default version status: affected
2.6.17affected0 to < 2.6.17unaffected5.10.258 to ≤ 5.10.*unaffected5.15.209 to ≤ 5.15.*unaffected6.1.175 to ≤ 6.1.*unaffected6.6.141 to ≤ 6.6.*unaffected6.12.91 to ≤ 6.12.*unaffected6.18.33 to ≤ 6.18.*unaffected7.0.10 to ≤ 7.0.*unaffected7.1 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/eb323f7b82d2e2f638de0cc2a177803eb20e0707 ↗
- https://git.kernel.org/stable/c/fc1c518bb1f054831ecabb32da9b8e1dff9699c6 ↗
- https://git.kernel.org/stable/c/f98b7f85e04b40e28b08c461ded0cc79f14f5509 ↗
- https://git.kernel.org/stable/c/82664d0f1ba25e4f9a71994954abae24c60f4067 ↗
- https://git.kernel.org/stable/c/b130a6eefa02bd4d475f2f059da8bcfb3e7d18d9 ↗
- https://git.kernel.org/stable/c/938867e870fb5471bb16f442aeac81326e05bf65 ↗
- https://git.kernel.org/stable/c/392cc1d8408b5665215c1e9290bbf0f92339b043 ↗
- https://git.kernel.org/stable/c/4b2b4d7d4e203c92db8966b163edfacb1f0e1e29 ↗