Description
In the Linux kernel, the following vulnerability has been resolved: vxlan: vnifilter: enforce exact length of GROUP/GROUP6 attributes The VXLAN VNI filter entry policy declares the GROUP/GROUP6 address attributes as NLA_BINARY with only a maximum length, so validate_nla() accepts a payload shorter than the address. The GROUP consumer reads it with nla_get_in_addr(), an unconditional 4-byte load, so a short attribute over-reads up to 3 bytes of uninitialised slab data, which are stored into remote_ip and echoed back via RTM_GETTUNNEL, disclosing kernel memory. Switch both entries to NLA_POLICY_EXACT_LEN() so the validator rejects any GROUP/GROUP6 that is not exactly 4 / 16 bytes; a valid address is always sent at full width.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
f9c4bb0b245cee35ef66f75bf409c9573d934cf9 to < e12c4663529699f457b2988c1dfedf4d13b3b3beaffectedf9c4bb0b245cee35ef66f75bf409c9573d934cf9 to < 47bfcc871576eaef6c8edab6749acd4b317306eaaffectedf9c4bb0b245cee35ef66f75bf409c9573d934cf9 to < a9ec10815199f9879ba080241dc555efb1daf324affectedf9c4bb0b245cee35ef66f75bf409c9573d934cf9 to < daebc7064a1b4c12c98e52c4bceede7f2fcd573caffectedf9c4bb0b245cee35ef66f75bf409c9573d934cf9 to < ad32e564c62ebf5ba76dd60a22af52c69d54d17baffectedf9c4bb0b245cee35ef66f75bf409c9573d934cf9 to < 984f831dda31b3a18f47454cf64989f65402879eaffected
Linux Linux
Default version status: affected
5.18affected0 to < 5.18unaffected6.1.188 to ≤ 6.1.*unaffected6.6.157 to ≤ 6.6.*unaffected6.12.110 to ≤ 6.12.*unaffected6.18.52 to ≤ 6.18.*unaffected7.2.6 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/e12c4663529699f457b2988c1dfedf4d13b3b3be ↗
- https://git.kernel.org/stable/c/47bfcc871576eaef6c8edab6749acd4b317306ea ↗
- https://git.kernel.org/stable/c/a9ec10815199f9879ba080241dc555efb1daf324 ↗
- https://git.kernel.org/stable/c/daebc7064a1b4c12c98e52c4bceede7f2fcd573c ↗
- https://git.kernel.org/stable/c/ad32e564c62ebf5ba76dd60a22af52c69d54d17b ↗
- https://git.kernel.org/stable/c/984f831dda31b3a18f47454cf64989f65402879e ↗