Description
In the Linux kernel, the following vulnerability has been resolved: ipv4: fib: bound automatic table ID allocation fib_empty_table() probes every table ID from 1 until it finds a free one. IPv4 tables are stored in a 256-bucket hash table, so a dense set of IDs makes each probe walk a growing hash chain while RTNL is held. Automatic table assignment ("ip rule ... table 0") is an IPv4-only legacy path. Bound the automatically allocated ID to 4096 so the RTNL hold stays bounded, without changing lookups of explicitly specified table IDs. This changes user-visible behavior. A table-0 rule previously received the lowest free ID in 1..RT_TABLE_MAX (0xFFFFFFFF). After this patch the search stops at 4096 and the rule add fails with ENOBUFS if that range is fully occupied. Explicit table IDs above 4096 remain usable. The automatic path is unused in practice: it is IPv4-only, not documented by ip-rule, uncovered by kernel selftests, and both NetworkManager and systemd refuse table 0.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
b801f54917b7c6e8540f877ee562cd0725e62ebd to < 999bc00588cb305ab25065e8a8ac31da7465301caffectedb801f54917b7c6e8540f877ee562cd0725e62ebd to < f1f2da33eaab54b4d5cdea6d70befb2e2fb49cb6affectedb801f54917b7c6e8540f877ee562cd0725e62ebd to < 125890702ef4417cd0ffac2e448c0cd4fbf0ac45affectedb801f54917b7c6e8540f877ee562cd0725e62ebd to < 3080f9e653d8c057d5652db5ced8137f81b3fcbdaffectedb801f54917b7c6e8540f877ee562cd0725e62ebd to < bc8d01d856db106f284b19961af6112e10c3e3b4affectedb801f54917b7c6e8540f877ee562cd0725e62ebd to < fe9a906d2bff2d2707bafd6353b5e032a42aeb35affectedb801f54917b7c6e8540f877ee562cd0725e62ebd to < 2c29c053a6627dc4f12fcfe6b4860bcd9e5d7503affectedb801f54917b7c6e8540f877ee562cd0725e62ebd to < efdfb1e27a3328085b79540dfe781d537b576ea1affected
Linux Linux
Default version status: affected
2.6.19affected0 to < 2.6.19unaffected5.10.271 to ≤ 5.10.*unaffected5.15.222 to ≤ 5.15.*unaffected6.1.189 to ≤ 6.1.*unaffected6.6.158 to ≤ 6.6.*unaffected6.12.111 to ≤ 6.12.*unaffected6.18.53 to ≤ 6.18.*unaffected7.2.7 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/999bc00588cb305ab25065e8a8ac31da7465301c ↗
- https://git.kernel.org/stable/c/f1f2da33eaab54b4d5cdea6d70befb2e2fb49cb6 ↗
- https://git.kernel.org/stable/c/125890702ef4417cd0ffac2e448c0cd4fbf0ac45 ↗
- https://git.kernel.org/stable/c/3080f9e653d8c057d5652db5ced8137f81b3fcbd ↗
- https://git.kernel.org/stable/c/bc8d01d856db106f284b19961af6112e10c3e3b4 ↗
- https://git.kernel.org/stable/c/fe9a906d2bff2d2707bafd6353b5e032a42aeb35 ↗
- https://git.kernel.org/stable/c/2c29c053a6627dc4f12fcfe6b4860bcd9e5d7503 ↗
- https://git.kernel.org/stable/c/efdfb1e27a3328085b79540dfe781d537b576ea1 ↗