Description
In the Linux kernel, the following vulnerability has been resolved: net: slip: serialize receive against buffer reallocation sl_realloc_bufs() replaces rbuff and updates buffsize while holding sl->lock. slip_receive_buf() reads those fields and writes through rbuff without holding the lock. An MTU change can therefore race with receive processing. An MTU shrink can expose the new smaller rbuff with the old larger bound, causing an out-of-bounds write. A receive callback which already loaded the old rbuff can instead continue writing after that buffer has been freed. Serialize receive processing with sl_realloc_bufs() by holding sl->lock while consuming each receive batch.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 8180daf2b66155f84ec4f9e3f95488c8a3421716affected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 189a550eb7e1dc10018718ddfc46d003ffe58653affected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 1be09d175b627fad7f6bec7ad27b8a4a99863912affected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < eb3836eab47487823f362e6985e170a1e15f20fdaffected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 44401f7dd9940ced7098930ef64f5a332f279fc2affected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 5d07b178bef511d69558cfc89fe1129258dc39f8affected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 0e37bbd6d617eb52bace49390e99eaedc1af73ceaffected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < ee7f9bb9320add61f7b367d7e6cd55e3a3a4d65daffected
Linux Linux
Default version status: affected
2.6.12affected0 to < 2.6.12unaffected5.10.265 to ≤ 5.10.*unaffected5.15.216 to ≤ 5.15.*unaffected6.1.183 to ≤ 6.1.*unaffected6.6.148 to ≤ 6.6.*unaffected6.12.101 to ≤ 6.12.*unaffected6.18.42 to ≤ 6.18.*unaffected7.1.6 to ≤ 7.1.*unaffected7.2 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/8180daf2b66155f84ec4f9e3f95488c8a3421716 ↗
- https://git.kernel.org/stable/c/189a550eb7e1dc10018718ddfc46d003ffe58653 ↗
- https://git.kernel.org/stable/c/1be09d175b627fad7f6bec7ad27b8a4a99863912 ↗
- https://git.kernel.org/stable/c/eb3836eab47487823f362e6985e170a1e15f20fd ↗
- https://git.kernel.org/stable/c/44401f7dd9940ced7098930ef64f5a332f279fc2 ↗
- https://git.kernel.org/stable/c/5d07b178bef511d69558cfc89fe1129258dc39f8 ↗
- https://git.kernel.org/stable/c/0e37bbd6d617eb52bace49390e99eaedc1af73ce ↗
- https://git.kernel.org/stable/c/ee7f9bb9320add61f7b367d7e6cd55e3a3a4d65d ↗