Description
In the Linux kernel, the following vulnerability has been resolved: batman-adv: tvlv: reject oversized TVLV packets batadv_tvlv_container_ogm_append() builds a TVLV packet section from the tvlv.container_list. The total size of this section is computed by batadv_tvlv_container_list_size(), which sums the sizes of all registered containers. The return type and accumulator in batadv_tvlv_container_list_size() were u16. If the accumulated size exceeds U16_MAX, the value wraps around, causing the subsequent allocation in batadv_tvlv_container_ogm_append() to be undersized. The memcpy-style copy that follows would then write beyond the end of the allocated buffer, corrupting kernel memory. Fix this by widening the return type of batadv_tvlv_container_list_size() to size_t. In batadv_tvlv_container_ogm_append(), check the computed length against U16_MAX before proceeding, and bail out as if the allocation had failed when the limit is exceeded.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
ef26157747d42254453f6b3ac2bd8bd3c53339c3 to < c02aa6c0c9d1bea9bb75dea362b75ad225137baeaffectedef26157747d42254453f6b3ac2bd8bd3c53339c3 to < 1595628a2f877d052eda18865ccf539392c47c04affectedef26157747d42254453f6b3ac2bd8bd3c53339c3 to < 6448a49344e87487b61bd88cb850cd694a0f576daffectedef26157747d42254453f6b3ac2bd8bd3c53339c3 to < 13493b00dd1e05a705981e052158652ea23eb482affectedef26157747d42254453f6b3ac2bd8bd3c53339c3 to < 94db72e9dac202e017ee3db22c59d17e4f3bf171affectedef26157747d42254453f6b3ac2bd8bd3c53339c3 to < ede47988ac5687793745b17c1634a496a2299919affectedef26157747d42254453f6b3ac2bd8bd3c53339c3 to < 94a3d72cd9b21116d7c6d5bdc57c11401fc28557affectedef26157747d42254453f6b3ac2bd8bd3c53339c3 to < f50487e3566358b2b982b7801945e858c78ad9abaffected
Linux Linux
Default version status: affected
3.13affected0 to < 3.13unaffected5.10.259 to ≤ 5.10.*unaffected5.15.210 to ≤ 5.15.*unaffected6.1.176 to ≤ 6.1.*unaffected6.6.143 to ≤ 6.6.*unaffected6.12.93 to ≤ 6.12.*unaffected6.18.34 to ≤ 6.18.*unaffected7.0.11 to ≤ 7.0.*unaffected7.1 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/c02aa6c0c9d1bea9bb75dea362b75ad225137bae ↗
- https://git.kernel.org/stable/c/1595628a2f877d052eda18865ccf539392c47c04 ↗
- https://git.kernel.org/stable/c/6448a49344e87487b61bd88cb850cd694a0f576d ↗
- https://git.kernel.org/stable/c/13493b00dd1e05a705981e052158652ea23eb482 ↗
- https://git.kernel.org/stable/c/94db72e9dac202e017ee3db22c59d17e4f3bf171 ↗
- https://git.kernel.org/stable/c/ede47988ac5687793745b17c1634a496a2299919 ↗
- https://git.kernel.org/stable/c/94a3d72cd9b21116d7c6d5bdc57c11401fc28557 ↗
- https://git.kernel.org/stable/c/f50487e3566358b2b982b7801945e858c78ad9ab ↗