Description
In the Linux kernel, the following vulnerability has been resolved: net: atm: reject out-of-range traffic classes in QoS validation Reject ATM traffic classes above ATM_ANYCLASS in check_tp(). SO_ATMQOS stores the supplied QoS after check_qos() succeeds, so accepting larger values leaves invalid traffic_class values in vcc->qos. That bad state later reaches pvc_info(), which indexes class_name[] with vcc->qos.{rx,tp}.traffic_class. Values above ATM_ANYCLASS cause an out-of-bounds read when /proc/net/atm/pvc is read. Tighten the existing QoS validation so invalid traffic_class values are rejected at the point where user supplied QoS is accepted.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 1a6dda72455b399ce9c1a12695471dc4d5c61addaffected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 2b3e241729e87afed13ac0f666472d5d6ca42e87affected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 367acd288bc6255e247cb1a1efbf5c6567cab423affected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 513f820b3f0cf4462e17d84c39ed3948d061a6eaaffected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 15444b57fdc6fc3f3e22a87f791ae5be81e6ecf5affected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < e62adb157c2eaad9ad4867ec6cd9af5b9a51b1c7affected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 806b7b6edc8446e8b94b706807a7090a14d47b5caffected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < cdf19f380e46192e7084be559638aab1f6ed86a2affected
Linux Linux
Default version status: affected
2.6.12affected0 to < 2.6.12unaffected5.10.261 to ≤ 5.10.*unaffected5.15.212 to ≤ 5.15.*unaffected6.1.178 to ≤ 6.1.*unaffected6.6.145 to ≤ 6.6.*unaffected6.12.97 to ≤ 6.12.*unaffected6.18.40 to ≤ 6.18.*unaffected7.1.5 to ≤ 7.1.*unaffected7.2 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/1a6dda72455b399ce9c1a12695471dc4d5c61add ↗
- https://git.kernel.org/stable/c/2b3e241729e87afed13ac0f666472d5d6ca42e87 ↗
- https://git.kernel.org/stable/c/367acd288bc6255e247cb1a1efbf5c6567cab423 ↗
- https://git.kernel.org/stable/c/513f820b3f0cf4462e17d84c39ed3948d061a6ea ↗
- https://git.kernel.org/stable/c/15444b57fdc6fc3f3e22a87f791ae5be81e6ecf5 ↗
- https://git.kernel.org/stable/c/e62adb157c2eaad9ad4867ec6cd9af5b9a51b1c7 ↗
- https://git.kernel.org/stable/c/806b7b6edc8446e8b94b706807a7090a14d47b5c ↗
- https://git.kernel.org/stable/c/cdf19f380e46192e7084be559638aab1f6ed86a2 ↗