Description
In the Linux kernel, the following vulnerability has been resolved: net/ionic: avoid OOB TX partner lookup for hwstamp RXQ The dedicated hardware timestamp RX queue is allocated with q->index equal to lif->ionic->nrxqs_per_lif. The normal txqcqs array only contains the regular queue pairs, so using that index to set rxq->partner can read one entry past txqcqs[] and then write through the derived pointer. Only link RX/TX partners for normal queue-pair indexes. Leave the hwstamp RX queue unpaired, and make the XDP_TX path abort cleanly if an RX queue has no TX partner.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
8eeed8373e1cca836799bf8e4a05cffa8e444908 to < 881a805a8029ba48c0ce81c6674910f8d83f7afbaffected8eeed8373e1cca836799bf8e4a05cffa8e444908 to < 39fc615e355b65b8d43be30da57aa95ae6eaf688affected8eeed8373e1cca836799bf8e4a05cffa8e444908 to < f3868046e8e2e761d4d943a232bd109ff22a7d5baffected8eeed8373e1cca836799bf8e4a05cffa8e444908 to < ea081b4435515ac7177eb598a3c0678d1b9e7911affected8eeed8373e1cca836799bf8e4a05cffa8e444908 to < d92255b405fb6f5acca408239ccd742e0a42c9cbaffected
Linux Linux
Default version status: affected
6.9affected0 to < 6.9unaffected6.12.106 to ≤ 6.12.*unaffected6.18.47 to ≤ 6.18.*unaffected7.1.11 to ≤ 7.1.*unaffected7.2.1 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/881a805a8029ba48c0ce81c6674910f8d83f7afb ↗
- https://git.kernel.org/stable/c/39fc615e355b65b8d43be30da57aa95ae6eaf688 ↗
- https://git.kernel.org/stable/c/f3868046e8e2e761d4d943a232bd109ff22a7d5b ↗
- https://git.kernel.org/stable/c/ea081b4435515ac7177eb598a3c0678d1b9e7911 ↗
- https://git.kernel.org/stable/c/d92255b405fb6f5acca408239ccd742e0a42c9cb ↗