Description
In the Linux kernel, the following vulnerability has been resolved: batman-adv: tt: prevent TVLV OOB check overflow A TT unicast TVLV contains the number of VLANs stored in it. This number is an u16 and gets multiplied by the size of the struct batadv_tvlv_tt_vlan_data (8 bytes). The size can therefore overflow the u16 used to store the tt_vlan_len. All additional safety checks to prevent out-of-bounds access of the TVLV buffer are invalid due to this overflow. Using size_t prevents this overflow and ensures that the safety checks compare against the actual buffer requirements.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
7ea7b4a142758deaf46c1af0ca9ceca6dd55138b to < 0de12a4c4847f571d82a9cd96bc633eded41d7c6affected7ea7b4a142758deaf46c1af0ca9ceca6dd55138b to < d6ff4764ff784ede25f5c83a6f5883a74c93a5eaaffected7ea7b4a142758deaf46c1af0ca9ceca6dd55138b to < 1898273c5dc8148267ef9f97cd2517a2822350e7affected7ea7b4a142758deaf46c1af0ca9ceca6dd55138b to < 604bd5042fbcd1ab9f7cd98fd847ec017aeede8aaffected7ea7b4a142758deaf46c1af0ca9ceca6dd55138b to < 7319c0794f91be2734aac695794e7203606b49f8affected7ea7b4a142758deaf46c1af0ca9ceca6dd55138b to < 3256c05d5a9db34346eaf20f52dddde984852d77affected7ea7b4a142758deaf46c1af0ca9ceca6dd55138b to < 6222b443686525cb5a9b6a9cecf23b2e2ab23e2aaffected7ea7b4a142758deaf46c1af0ca9ceca6dd55138b to < 7a581d9aaba8c82bd6177fa36b2588eea77f6e2baffected
Linux Linux
Default version status: affected
3.13affected0 to < 3.13unaffected5.10.261 to ≤ 5.10.*unaffected5.15.212 to ≤ 5.15.*unaffected6.1.178 to ≤ 6.1.*unaffected6.6.145 to ≤ 6.6.*unaffected6.12.97 to ≤ 6.12.*unaffected6.18.40 to ≤ 6.18.*unaffected7.1.5 to ≤ 7.1.*unaffected7.2 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/0de12a4c4847f571d82a9cd96bc633eded41d7c6 ↗
- https://git.kernel.org/stable/c/d6ff4764ff784ede25f5c83a6f5883a74c93a5ea ↗
- https://git.kernel.org/stable/c/1898273c5dc8148267ef9f97cd2517a2822350e7 ↗
- https://git.kernel.org/stable/c/604bd5042fbcd1ab9f7cd98fd847ec017aeede8a ↗
- https://git.kernel.org/stable/c/7319c0794f91be2734aac695794e7203606b49f8 ↗
- https://git.kernel.org/stable/c/3256c05d5a9db34346eaf20f52dddde984852d77 ↗
- https://git.kernel.org/stable/c/6222b443686525cb5a9b6a9cecf23b2e2ab23e2a ↗
- https://git.kernel.org/stable/c/7a581d9aaba8c82bd6177fa36b2588eea77f6e2b ↗