Description
In the Linux kernel, the following vulnerability has been resolved: bpf: reject short IPv4/IPv6 inputs in bpf_prog_test_run_skb bpf_prog_test_run_skb() calls eth_type_trans() first and then uses skb->protocol to initialize sk family and address fields for the test run. For IPv4 and IPv6 packets, it may access ip_hdr(skb) or ipv6_hdr(skb) even when the provided test input only contains an Ethernet header. Reject the input earlier if the Ethernet frame carries IPv4/IPv6 EtherType but the L3 header is too short. Fold the IPv4/IPv6 header length checks into the existing protocol switch and return -EINVAL before accessing the network headers.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
fa5cb548ced61b9d3095f32f8a7e427a248c65ee to < 7254267799d083280c0e53effc101a33add95f7baffectedfa5cb548ced61b9d3095f32f8a7e427a248c65ee to < 6a9f38d5ff11e00bc54baab752642978805e81ebaffectedfa5cb548ced61b9d3095f32f8a7e427a248c65ee to < e6aa481f21fc7a41ed344767ea25aae9d03fae71affectedfa5cb548ced61b9d3095f32f8a7e427a248c65ee to < 0a04db240effd85773f66244645a28cedddb72d2affectedfa5cb548ced61b9d3095f32f8a7e427a248c65ee to < 1f882c492d46f90bdb36f4936876c88c28dab21caffectedfa5cb548ced61b9d3095f32f8a7e427a248c65ee to < 8042240412de3222d27b31e89d29336961cad9e4affectedfa5cb548ced61b9d3095f32f8a7e427a248c65ee to < 6def5fe753cbe5b279ee5fd10327b2611cbddacaaffectedfa5cb548ced61b9d3095f32f8a7e427a248c65ee to < 12bec2bd4b76d81c5d3996bd14ec1b7f4d983747affected
Linux Linux
Default version status: affected
5.9affected0 to < 5.9unaffected5.10.258 to ≤ 5.10.*unaffected5.15.209 to ≤ 5.15.*unaffected6.1.175 to ≤ 6.1.*unaffected6.6.141 to ≤ 6.6.*unaffected6.12.91 to ≤ 6.12.*unaffected6.18.33 to ≤ 6.18.*unaffected7.0.10 to ≤ 7.0.*unaffected7.1 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/7254267799d083280c0e53effc101a33add95f7b ↗
- https://git.kernel.org/stable/c/6a9f38d5ff11e00bc54baab752642978805e81eb ↗
- https://git.kernel.org/stable/c/e6aa481f21fc7a41ed344767ea25aae9d03fae71 ↗
- https://git.kernel.org/stable/c/0a04db240effd85773f66244645a28cedddb72d2 ↗
- https://git.kernel.org/stable/c/1f882c492d46f90bdb36f4936876c88c28dab21c ↗
- https://git.kernel.org/stable/c/8042240412de3222d27b31e89d29336961cad9e4 ↗
- https://git.kernel.org/stable/c/6def5fe753cbe5b279ee5fd10327b2611cbddaca ↗
- https://git.kernel.org/stable/c/12bec2bd4b76d81c5d3996bd14ec1b7f4d983747 ↗