Description
In the Linux kernel, the following vulnerability has been resolved: vlan: ensure sufficient headroom in vlan_dev_hard_header() Callers that only reserve ETH_HLEN or less (such as llc_alloc_frame()), or skbs allocated before dynamic device/headroom changes (e.g. toggling VLAN_FLAG_REORDER_HDR or bonding/team switching slaves), can reach vlan_dev_hard_header() with insufficient headroom and trigger skb_under_panic(). Use skb_cow_head() in vlan_dev_hard_header() when VLAN_FLAG_REORDER_HDR is not set to ensure sufficient headroom for the VLAN header(s) and the underlying device hard header. Use READ_ONCE() to read dev->hard_header_len and dev->needed_headroom as they can be updated concurrently under RTNL (e.g. in vlan_transfer_features()) while vlan_dev_hard_header() runs locklessly on the transmit path. Also avoid LL_RESERVED_SPACE(dev) here so that the extra HH_DATA_MOD alignment padding does not trigger unnecessary pskb_expand_head() reallocations on inner stacked VLAN devices after the outer VLAN header has been pushed.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 55e007fc3b4d76fa4d6b4660f6904fe6ab045a1baffected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 5aca8e6a8ff6aeae358c1d9b65447aac416ace95affected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 4ba1f57313f36a3ce6f77d593548f0c511f34aa1affected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < ca797491f0ae4bfde9039f79f6f1ed7781c9110faffected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < cfba0f45553de2b803059e3d539a1e418df24da8affected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < c7ee4bea64f559ea8e03260014775b64c720cb5baffected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 90d51095371d96747f45bbd8504edf6513e039efaffected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < cd5dd68267c4238795fadaf02b3575ca3f8a6500affected
Linux Linux
Default version status: affected
2.6.12affected0 to < 2.6.12unaffected5.10.271 to ≤ 5.10.*unaffected5.15.222 to ≤ 5.15.*unaffected6.1.189 to ≤ 6.1.*unaffected6.6.158 to ≤ 6.6.*unaffected6.12.112 to ≤ 6.12.*unaffected6.18.55 to ≤ 6.18.*unaffected7.2.9 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/55e007fc3b4d76fa4d6b4660f6904fe6ab045a1b ↗
- https://git.kernel.org/stable/c/5aca8e6a8ff6aeae358c1d9b65447aac416ace95 ↗
- https://git.kernel.org/stable/c/4ba1f57313f36a3ce6f77d593548f0c511f34aa1 ↗
- https://git.kernel.org/stable/c/ca797491f0ae4bfde9039f79f6f1ed7781c9110f ↗
- https://git.kernel.org/stable/c/cfba0f45553de2b803059e3d539a1e418df24da8 ↗
- https://git.kernel.org/stable/c/c7ee4bea64f559ea8e03260014775b64c720cb5b ↗
- https://git.kernel.org/stable/c/90d51095371d96747f45bbd8504edf6513e039ef ↗
- https://git.kernel.org/stable/c/cd5dd68267c4238795fadaf02b3575ca3f8a6500 ↗