Description
In the Linux kernel, the following vulnerability has been resolved: ecryptfs: pass packet set buffer size to parser ecryptfs_parse_packet_set() receives a pointer into the file header, but it calculates the remaining packet buffer size from PAGE_SIZE - 8. For version 1 headers the packet set starts later in the header, so this can overstate the available buffer. Pass the actual packet set buffer length from the caller and calculate per-packet limits from the remaining bytes in that buffer. Recompute the remaining length after consuming a tag 3 packet before parsing the following tag 11 packet.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
237fead619984cc48818fe12ee0ceada3f55b012 to < e7573b0e3058c6bbdfe81673f22c09900fde9e65affected237fead619984cc48818fe12ee0ceada3f55b012 to < 66a87559ecb26afe80ad512faf728a158e2b81daaffected237fead619984cc48818fe12ee0ceada3f55b012 to < 3bd9bb3e167a7c14a50423f6ff03ee0fb007199daffected237fead619984cc48818fe12ee0ceada3f55b012 to < 749fa08d8f1b318bd8f4669a14a8a4a8c1bbdaacaffected237fead619984cc48818fe12ee0ceada3f55b012 to < 329de8b9e988b152b938f09224670d97bada0b96affected237fead619984cc48818fe12ee0ceada3f55b012 to < e5d254e654f2311a3c4b9c791d7f216554bcd17aaffected237fead619984cc48818fe12ee0ceada3f55b012 to < 747fd45be396a6aea3420ab657a0ab4e60185b05affected237fead619984cc48818fe12ee0ceada3f55b012 to < 2602b79c5b3e2f6fce12e38a670f8e3fda4e46a2affected
Linux Linux
Default version status: affected
2.6.19affected0 to < 2.6.19unaffected5.10.270 to ≤ 5.10.*unaffected5.15.221 to ≤ 5.15.*unaffected6.1.188 to ≤ 6.1.*unaffected6.6.157 to ≤ 6.6.*unaffected6.12.109 to ≤ 6.12.*unaffected6.18.50 to ≤ 6.18.*unaffected7.2.4 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/e7573b0e3058c6bbdfe81673f22c09900fde9e65 ↗
- https://git.kernel.org/stable/c/66a87559ecb26afe80ad512faf728a158e2b81da ↗
- https://git.kernel.org/stable/c/3bd9bb3e167a7c14a50423f6ff03ee0fb007199d ↗
- https://git.kernel.org/stable/c/749fa08d8f1b318bd8f4669a14a8a4a8c1bbdaac ↗
- https://git.kernel.org/stable/c/329de8b9e988b152b938f09224670d97bada0b96 ↗
- https://git.kernel.org/stable/c/e5d254e654f2311a3c4b9c791d7f216554bcd17a ↗
- https://git.kernel.org/stable/c/747fd45be396a6aea3420ab657a0ab4e60185b05 ↗
- https://git.kernel.org/stable/c/2602b79c5b3e2f6fce12e38a670f8e3fda4e46a2 ↗