Description
In the Linux kernel, the following vulnerability has been resolved: net: bridge: Reject descending VLAN tunnel ranges A pair of descending VLAN and tunnel IDs can pass the tunnel range span check. The VLAN subtraction produces a negative int, which is converted to unsigned when compared with the u32 tunnel ID subtraction. It can therefore equal the wrapped tunnel ID delta. The range loop then performs no iterations. Since the batched notification handling added a post-loop error check, this leaves err uninitialized and makes the request's return value unpredictable. Reject descending VLAN ranges before comparing the spans. Valid ascending and single-entry ranges remain unchanged, while malformed descending ranges consistently return -EINVAL. This issue was found by a static analysis checker and confirmed by manual source review.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
94339443686b36d3223bc032b7947267474e2679 to < 1181f6bad009408a259bab6aaf0681f11b487972affected94339443686b36d3223bc032b7947267474e2679 to < 5a8e0e3a18b5e3172343b8479c5d04187f5b4795affected94339443686b36d3223bc032b7947267474e2679 to < 0874a6d5275091429ec4c675c54c53a8776665aeaffected94339443686b36d3223bc032b7947267474e2679 to < 4b0f5b25f114651f03058395b490626c4444875eaffected94339443686b36d3223bc032b7947267474e2679 to < bd741b819ff1c239d26cc5b0f0e6b1fd4e67ed17affected94339443686b36d3223bc032b7947267474e2679 to < c0444d7499f113d6b7803ef0175591464e17525eaffected94339443686b36d3223bc032b7947267474e2679 to < 434849b21ef56b09d16e6366b2a230002f363e45affected94339443686b36d3223bc032b7947267474e2679 to < b74a072d8fb71d3c9ffba4a17d5943e63266fb38affected
Linux Linux
Default version status: affected
5.9affected0 to < 5.9unaffected5.10.270 to ≤ 5.10.*unaffected5.15.221 to ≤ 5.15.*unaffected6.1.188 to ≤ 6.1.*unaffected6.6.157 to ≤ 6.6.*unaffected6.12.110 to ≤ 6.12.*unaffected6.18.52 to ≤ 6.18.*unaffected7.2.6 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/1181f6bad009408a259bab6aaf0681f11b487972 ↗
- https://git.kernel.org/stable/c/5a8e0e3a18b5e3172343b8479c5d04187f5b4795 ↗
- https://git.kernel.org/stable/c/0874a6d5275091429ec4c675c54c53a8776665ae ↗
- https://git.kernel.org/stable/c/4b0f5b25f114651f03058395b490626c4444875e ↗
- https://git.kernel.org/stable/c/bd741b819ff1c239d26cc5b0f0e6b1fd4e67ed17 ↗
- https://git.kernel.org/stable/c/c0444d7499f113d6b7803ef0175591464e17525e ↗
- https://git.kernel.org/stable/c/434849b21ef56b09d16e6366b2a230002f363e45 ↗
- https://git.kernel.org/stable/c/b74a072d8fb71d3c9ffba4a17d5943e63266fb38 ↗