Description
In the Linux kernel, the following vulnerability has been resolved: 6lowpan: fix off-by-one in multicast context address compression The second memcpy in lowpan_iphc_mcast_ctx_addr_compress() uses &data[1] as destination and &ipaddr->s6_addr[11] as source, but both should be offset by one: &data[2] and &ipaddr->s6_addr[12] respectively. This off-by-one has two consequences: 1. data[1] is overwritten with s6_addr[11], corrupting the RIID field in the compressed multicast address 2. data[5] is never written, so uninitialized kernel stack memory is transmitted over the network via lowpan_push_hc_data(), leaking kernel stack contents The correct inline data layout must match what the decompression function lowpan_uncompress_multicast_ctx_daddr() expects: data[0..1] = s6_addr[1..2] (flags/scope + RIID) data[2..5] = s6_addr[12..15] (group ID) Also zero-initialize the data array as a defensive measure against similar bugs in the future.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
5609c185f24dffca5f6a9c127106869da150be03 to < f24a58c72a45f4c109f3557a760cc4b60b7a6037affected5609c185f24dffca5f6a9c127106869da150be03 to < da8cbb64b47e9066b40af0de170901caf17b768caffected5609c185f24dffca5f6a9c127106869da150be03 to < 4485d79617520d84ba5a14515e2b5136007d6debaffected5609c185f24dffca5f6a9c127106869da150be03 to < 06ce6fc106b16dec9b535950db626261be865e5baffected5609c185f24dffca5f6a9c127106869da150be03 to < dcb1bec1c32ee5c3878354e087cf5dbee2b7c7afaffected5609c185f24dffca5f6a9c127106869da150be03 to < c32f30ef5e66adbfa102348e2e8a23776eb007cbaffected5609c185f24dffca5f6a9c127106869da150be03 to < da8808463882c3f3c357b072e25053c2121f1419affected5609c185f24dffca5f6a9c127106869da150be03 to < 2a58899d11009bffc7b4b32a571858f381121837affected
Linux Linux
Default version status: affected
4.6affected0 to < 4.6unaffected5.10.259 to ≤ 5.10.*unaffected5.15.210 to ≤ 5.15.*unaffected6.1.176 to ≤ 6.1.*unaffected6.6.143 to ≤ 6.6.*unaffected6.12.94 to ≤ 6.12.*unaffected6.18.36 to ≤ 6.18.*unaffected7.0.13 to ≤ 7.0.*unaffected7.1 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/f24a58c72a45f4c109f3557a760cc4b60b7a6037 ↗
- https://git.kernel.org/stable/c/da8cbb64b47e9066b40af0de170901caf17b768c ↗
- https://git.kernel.org/stable/c/4485d79617520d84ba5a14515e2b5136007d6deb ↗
- https://git.kernel.org/stable/c/06ce6fc106b16dec9b535950db626261be865e5b ↗
- https://git.kernel.org/stable/c/dcb1bec1c32ee5c3878354e087cf5dbee2b7c7af ↗
- https://git.kernel.org/stable/c/c32f30ef5e66adbfa102348e2e8a23776eb007cb ↗
- https://git.kernel.org/stable/c/da8808463882c3f3c357b072e25053c2121f1419 ↗
- https://git.kernel.org/stable/c/2a58899d11009bffc7b4b32a571858f381121837 ↗
- https://cert-portal.siemens.com/productcert/html/ssa-784472.html ↗