Description
In the Linux kernel, the following vulnerability has been resolved: netfilter: ebtables: zero chainstack array sashiko reports: looking at ebtables table translation, could a sparse cpu_possible_mask lead to an uninitialized pointer free? If cpu_possible_mask is sparse (for example, CPU 0 and CPU 2 are possible, but CPU 1 is not), the allocation loop skips CPU 1. If vmalloc_node() fails at CPU 2, the cleanup loop will blindly decrement and call vfree() on newinfo->chainstack[1]. Not a real-world bug, such allocation isn't expected to fail in the first place.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 2ade612967e2cdfb9290ebcb773f302c82f311faaffected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 42bef500d07b5769d916e9122a3e3fa3fd2245efaffected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < fc7f105451044501a50cfd530cfa3b472c54acbcaffected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 9e6c5169db423e51dcc66a73fd15409c0d38e088affected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 29bf41a9b59aff9f6197df58641a00037d567ca8affected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 9f74d28e903fa4fdf82f870d0aeadddc8196e41caffected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 5ee856e4208acafaaaf7b84824d39b78c21345d6affected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < cbfe53599eebffd188938ab6774cc41794f6f9d5affected
Linux Linux
Default version status: affected
2.6.12affected0 to < 2.6.12unaffected5.10.261 to ≤ 5.10.*unaffected5.15.212 to ≤ 5.15.*unaffected6.1.178 to ≤ 6.1.*unaffected6.6.145 to ≤ 6.6.*unaffected6.12.97 to ≤ 6.12.*unaffected6.18.39 to ≤ 6.18.*unaffected7.1.4 to ≤ 7.1.*unaffected7.2 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/2ade612967e2cdfb9290ebcb773f302c82f311fa ↗
- https://git.kernel.org/stable/c/42bef500d07b5769d916e9122a3e3fa3fd2245ef ↗
- https://git.kernel.org/stable/c/fc7f105451044501a50cfd530cfa3b472c54acbc ↗
- https://git.kernel.org/stable/c/9e6c5169db423e51dcc66a73fd15409c0d38e088 ↗
- https://git.kernel.org/stable/c/29bf41a9b59aff9f6197df58641a00037d567ca8 ↗
- https://git.kernel.org/stable/c/9f74d28e903fa4fdf82f870d0aeadddc8196e41c ↗
- https://git.kernel.org/stable/c/5ee856e4208acafaaaf7b84824d39b78c21345d6 ↗
- https://git.kernel.org/stable/c/cbfe53599eebffd188938ab6774cc41794f6f9d5 ↗
- https://cert-portal.siemens.com/productcert/html/ssa-019113.html ↗
- https://cert-portal.siemens.com/productcert/html/ssa-457936.html ↗