Description
In the Linux kernel, the following vulnerability has been resolved: ipvs: fix integer overflow in ftp helper port/address parsing ip_vs_ftp_get_addrport() accumulates decimal digits into a __u16 (hport) and into unsigned char (p[]) without checking for overflow. A crafted FTP PASV/EPSV response with an over-long port or address octet wraps the value, so the helper configures the data connection with a truncated port/address. The netfilter conntrack FTP helper had the same defect, fixed in commit 2b413fc689ba ("netfilter: nf_conntrack_ftp: avoid u16 overflows"). Apply the equivalent fix here: widen the port accumulator to u32 and reject values above 65535, and reject address octets above 255.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < d02de9a7a7e2484da0cf37e50614840623b98a62affected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < fc1493c905d7e0bc8830c1d83915cb7831daf1a1affected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 50cb9b7263a2ed01f7d2f97818a800c2ee05f661affected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < deaa88fa010ba0dfc554d09e006ddd1ce9945c82affected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 00bcc6d679262ea42688fba1d7819ea6e56f12efaffected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 4aed450adaee3a021db27be94c61fe025b0d05ffaffected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < b1908bff0faaa94d55be72da65879cad632e8236affected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < e625a9477d12baaff4025c5f9989184a907ea8fcaffected
Linux Linux
Default version status: affected
2.6.12affected0 to < 2.6.12unaffected5.10.270 to ≤ 5.10.*unaffected5.15.221 to ≤ 5.15.*unaffected6.1.188 to ≤ 6.1.*unaffected6.6.157 to ≤ 6.6.*unaffected6.12.110 to ≤ 6.12.*unaffected6.18.52 to ≤ 6.18.*unaffected7.2.6 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/d02de9a7a7e2484da0cf37e50614840623b98a62 ↗
- https://git.kernel.org/stable/c/fc1493c905d7e0bc8830c1d83915cb7831daf1a1 ↗
- https://git.kernel.org/stable/c/50cb9b7263a2ed01f7d2f97818a800c2ee05f661 ↗
- https://git.kernel.org/stable/c/deaa88fa010ba0dfc554d09e006ddd1ce9945c82 ↗
- https://git.kernel.org/stable/c/00bcc6d679262ea42688fba1d7819ea6e56f12ef ↗
- https://git.kernel.org/stable/c/4aed450adaee3a021db27be94c61fe025b0d05ff ↗
- https://git.kernel.org/stable/c/b1908bff0faaa94d55be72da65879cad632e8236 ↗
- https://git.kernel.org/stable/c/e625a9477d12baaff4025c5f9989184a907ea8fc ↗