Description
In the Linux kernel, the following vulnerability has been resolved: net: macb: drop in-flight Tx SKBs on close The MACB driver has since forever leaked the outgoing SKBs that have not yet been marked as completed. They live in queue->tx_skb which gets freed without remorse nor checking. macb_free_consistent() gets called in a few codepaths, but only close will trigger the added expressions. In macb_open() and macb_alloc_consistent() failure cases, queues' tx_skb just got allocated and are empty.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
89e5785fc8a6b9eafd37f2318a9a76d479c796be to < 0e9797dc4ebdefe1b7f931b1f92d5e98e5dbf655affected89e5785fc8a6b9eafd37f2318a9a76d479c796be to < 6124bd785073659c99385094657b77382ebce11baffected89e5785fc8a6b9eafd37f2318a9a76d479c796be to < 2143fdc0ce27adbb1caaa1a97e0bfb9f3750aef4affected89e5785fc8a6b9eafd37f2318a9a76d479c796be to < 26b131b2d5b55a81ef6182769d28105a870c0eb2affected89e5785fc8a6b9eafd37f2318a9a76d479c796be to < 109241d9880488aafd8e104832b4d4859ad57244affected89e5785fc8a6b9eafd37f2318a9a76d479c796be to < 27f575836cfebbf872dec020428742b10650a955affected
Linux Linux
Default version status: affected
2.6.20affected0 to < 2.6.20unaffected6.1.184 to ≤ 6.1.*unaffected6.6.148 to ≤ 6.6.*unaffected6.12.101 to ≤ 6.12.*unaffected6.18.40 to ≤ 6.18.*unaffected7.1.5 to ≤ 7.1.*unaffected7.2 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/0e9797dc4ebdefe1b7f931b1f92d5e98e5dbf655 ↗
- https://git.kernel.org/stable/c/6124bd785073659c99385094657b77382ebce11b ↗
- https://git.kernel.org/stable/c/2143fdc0ce27adbb1caaa1a97e0bfb9f3750aef4 ↗
- https://git.kernel.org/stable/c/26b131b2d5b55a81ef6182769d28105a870c0eb2 ↗
- https://git.kernel.org/stable/c/109241d9880488aafd8e104832b4d4859ad57244 ↗
- https://git.kernel.org/stable/c/27f575836cfebbf872dec020428742b10650a955 ↗