Description
In the Linux kernel, the following vulnerability has been resolved: ipv6: exthdrs: refresh nh after handling HAO option ip6_parse_tlv() caches skb_network_header(skb) in nh while walking IPv6 TLVs. ipv6_dest_hao() may call pskb_expand_head() for a cloned skb, which can move the skb head and invalidate the cached network header pointer. Refresh nh after ipv6_dest_hao() returns so any trailing padding or TLVs are parsed from the current skb head. This matches the existing pattern used in ip6_parse_tlv() after helpers that can modify skb header storage.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
a831f5bbc89a9978795504be9e1ff412043f8f77 to < b3ac54e5c905f86d22b502eacb5686a282c5659faffecteda831f5bbc89a9978795504be9e1ff412043f8f77 to < f8aabed3ff3e986920cf02a2a2785e08e586b234affecteda831f5bbc89a9978795504be9e1ff412043f8f77 to < 1a11eb7431e3d2882f5bd5939c5a9bbc65ccf4d1affecteda831f5bbc89a9978795504be9e1ff412043f8f77 to < 12d957979e4a800167842f1b42be6a606d227ebeaffecteda831f5bbc89a9978795504be9e1ff412043f8f77 to < ff375ed1cba81392346c5bfbf0bb7a13b2946f99affecteda831f5bbc89a9978795504be9e1ff412043f8f77 to < 751db1b802a067b7fff25880f4e9f9152a171538affecteda831f5bbc89a9978795504be9e1ff412043f8f77 to < 9b6dcc0a39fd71752937f0b6b3973e1416085dcfaffecteda831f5bbc89a9978795504be9e1ff412043f8f77 to < f7b52afe3592eae66e160586b45a3f2242972c63affected
Linux Linux
Default version status: affected
2.6.19affected0 to < 2.6.19unaffected5.10.259 to ≤ 5.10.*unaffected5.15.210 to ≤ 5.15.*unaffected6.1.176 to ≤ 6.1.*unaffected6.6.143 to ≤ 6.6.*unaffected6.12.93 to ≤ 6.12.*unaffected6.18.35 to ≤ 6.18.*unaffected7.0.12 to ≤ 7.0.*unaffected7.1 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/b3ac54e5c905f86d22b502eacb5686a282c5659f ↗
- https://git.kernel.org/stable/c/f8aabed3ff3e986920cf02a2a2785e08e586b234 ↗
- https://git.kernel.org/stable/c/1a11eb7431e3d2882f5bd5939c5a9bbc65ccf4d1 ↗
- https://git.kernel.org/stable/c/12d957979e4a800167842f1b42be6a606d227ebe ↗
- https://git.kernel.org/stable/c/ff375ed1cba81392346c5bfbf0bb7a13b2946f99 ↗
- https://git.kernel.org/stable/c/751db1b802a067b7fff25880f4e9f9152a171538 ↗
- https://git.kernel.org/stable/c/9b6dcc0a39fd71752937f0b6b3973e1416085dcf ↗
- https://git.kernel.org/stable/c/f7b52afe3592eae66e160586b45a3f2242972c63 ↗