Description
In the Linux kernel, the following vulnerability has been resolved: net: dsa: sja1105: flower: reject cross-chip redirect dsa_port_from_netdev() may return a valid port from a different switch chip. Programming another chip's port index into the local hardware causes redirection to the wrong port, or an out-of-bounds access if the index exceeds the local chip's port count. Apply a minimal fix that adds a check to catch this case and adjusts the extack message. When cls->common.skip_sw is not set, the operation could instead redirect to the upstream port and let the software or upstream switch(es) handle the forward, but that is not addressed here.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
dfacc5a23e227cabdff41b6202f510398e90d36b to < 6bf5158af52a5293e9160d8f2992c629ca14aa7daffecteddfacc5a23e227cabdff41b6202f510398e90d36b to < 277f8611e017d3ff1ab06af58a6c538b55da1cc8affecteddfacc5a23e227cabdff41b6202f510398e90d36b to < eb177aa00c392de3dc530c34f173a962216f82ddaffecteddfacc5a23e227cabdff41b6202f510398e90d36b to < d0e54098c072b6064cdcf8039075ada8b88583daaffecteddfacc5a23e227cabdff41b6202f510398e90d36b to < c999cc39775381b68ed66eae57c1425452672c0faffecteddfacc5a23e227cabdff41b6202f510398e90d36b to < abd7511e12b231798332afa04ed9bee9e84f9445affecteddfacc5a23e227cabdff41b6202f510398e90d36b to < cfa5274a5dc2a23b957da5dc806d2ac0c7a66af0affected
Linux Linux
Default version status: affected
5.8affected0 to < 5.8unaffected5.10.271 to ≤ 5.10.*unaffected5.15.222 to ≤ 5.15.*unaffected6.1.189 to ≤ 6.1.*unaffected6.6.158 to ≤ 6.6.*unaffected6.12.111 to ≤ 6.12.*unaffected6.18.53 to ≤ 6.18.*unaffected7.2 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/6bf5158af52a5293e9160d8f2992c629ca14aa7d ↗
- https://git.kernel.org/stable/c/277f8611e017d3ff1ab06af58a6c538b55da1cc8 ↗
- https://git.kernel.org/stable/c/eb177aa00c392de3dc530c34f173a962216f82dd ↗
- https://git.kernel.org/stable/c/d0e54098c072b6064cdcf8039075ada8b88583da ↗
- https://git.kernel.org/stable/c/c999cc39775381b68ed66eae57c1425452672c0f ↗
- https://git.kernel.org/stable/c/abd7511e12b231798332afa04ed9bee9e84f9445 ↗
- https://git.kernel.org/stable/c/cfa5274a5dc2a23b957da5dc806d2ac0c7a66af0 ↗