Description
In the Linux kernel, the following vulnerability has been resolved: pppoe: drop PFC frames RFC 2516 Section 7 states that Protocol Field Compression (PFC) is NOT RECOMMENDED for PPPoE. In practice, pppd does not support negotiating PFC for PPPoE sessions, and the current PPPoE driver assumes an uncompressed (2-byte) protocol field. However, the generic PPP layer function ppp_input() is not aware of the negotiation result, and still accepts PFC frames. If a peer with a broken implementation or an attacker sends a frame with a compressed (1-byte) protocol field, the subsequent PPP payload is shifted by one byte. This causes the network header to be 4-byte misaligned, which may trigger unaligned access exceptions on some architectures. To reduce the attack surface, drop PPPoE PFC frames. Introduce ppp_skb_is_compressed_proto() helper function to be used in both ppp_generic.c and pppoe.c to avoid open-coding.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
7fb1b8ca8fa1ee34ffc328f17f78da68c7cc04e6 to < cb3beef35ab5e0c1afca9fd7648c6ae499786377affected7fb1b8ca8fa1ee34ffc328f17f78da68c7cc04e6 to < ba758fdf1399f310b30098b6faa3fd043de47dd2affected7fb1b8ca8fa1ee34ffc328f17f78da68c7cc04e6 to < fcca1df05322bb04e344dd1178b54b76a08eb7c3affected7fb1b8ca8fa1ee34ffc328f17f78da68c7cc04e6 to < 8a5e840babc5c0fbd10c73728a13192347771ec6affected7fb1b8ca8fa1ee34ffc328f17f78da68c7cc04e6 to < 49e41b60ccd1bdbe9e218420f716dd5f9a2f9c71affected7fb1b8ca8fa1ee34ffc328f17f78da68c7cc04e6 to < 0cab5d077dd1efd2bd1a47271acc35894f945b4faffected7fb1b8ca8fa1ee34ffc328f17f78da68c7cc04e6 to < 2b5c3c040d020e3ab3b9a8887031202d96843b1eaffected7fb1b8ca8fa1ee34ffc328f17f78da68c7cc04e6 to < cc1ff87bce1ccd38410ab10960f576dcd17db679affected
Linux Linux
Default version status: affected
5.0affected0 to < 5.0unaffected5.10.258 to ≤ 5.10.*unaffected5.15.209 to ≤ 5.15.*unaffected6.1.175 to ≤ 6.1.*unaffected6.6.141 to ≤ 6.6.*unaffected6.12.91 to ≤ 6.12.*unaffected6.18.33 to ≤ 6.18.*unaffected7.0.10 to ≤ 7.0.*unaffected7.1 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/cb3beef35ab5e0c1afca9fd7648c6ae499786377 ↗
- https://git.kernel.org/stable/c/ba758fdf1399f310b30098b6faa3fd043de47dd2 ↗
- https://git.kernel.org/stable/c/fcca1df05322bb04e344dd1178b54b76a08eb7c3 ↗
- https://git.kernel.org/stable/c/8a5e840babc5c0fbd10c73728a13192347771ec6 ↗
- https://git.kernel.org/stable/c/49e41b60ccd1bdbe9e218420f716dd5f9a2f9c71 ↗
- https://git.kernel.org/stable/c/0cab5d077dd1efd2bd1a47271acc35894f945b4f ↗
- https://git.kernel.org/stable/c/2b5c3c040d020e3ab3b9a8887031202d96843b1e ↗
- https://git.kernel.org/stable/c/cc1ff87bce1ccd38410ab10960f576dcd17db679 ↗