Description
In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_flower: validate mask pointer after nla_next() fl_set_enc_opt() iterates the key's nested tunnel-option attributes with nla_for_each_attr() while advancing a single mask pointer via nla_next() at the bottom of each loop, so the mask cursor is driven by the number of key attributes rather than by the mask's own attributes. The nla_ok() added by commit c96adff956191 ("cls_flower: call nla_ok() before nla_next()") only validates the mask pointer that was just consumed; the pointer produced by nla_next() is used by the next iteration (fl_set_geneve_opt() and siblings) without any validation. The mask's nested attributes are validated with NL_VALIDATE_LIBERAL, which merely warns on trailing bytes that do not form a complete attribute. A mask carrying one valid attribute plus 1-3 residue bytes (or a non-aligned attribute length making msk_depth negative) therefore reaches the next iteration with msk_depth != 0, so neither the !msk_depth check in fl_set_enc_opt() nor the !depth check in the per-type helpers fires. nla_type() then reads past the mask payload and nla_parse_nested_deprecated() iterates with an nla_len taken from those bytes, reading well beyond the mask attribute (KASAN: slab-out-of-bounds read in __nla_validate_parse from fl_change()). Validate the advanced mask pointer as well: when the mask is not legitimately exhausted (msk_depth != 0) and the new pointer fails nla_ok(), reject the filter with -EINVAL. An exactly exhausted mask still skips the check, preserving exact-match behaviour for the remaining key attributes.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
238b5ebdb6a6e4bc90810b9f8ec0063b3dfda41a to < a9283d006eef7e3b56f0f279a49bb63f6e5e61dfaffectedc96adff95619178e2118925578343ad54857c80c to < 497944d534ffb1be300365523030c7c6517cbbb6affectedc96adff95619178e2118925578343ad54857c80c to < a55d84907337580d91c0d54779d9d4b934633158affectedc96adff95619178e2118925578343ad54857c80c to < cff9bf34afde46c238189cc6f7690b7e35225df1affectedc96adff95619178e2118925578343ad54857c80c to < 35354bf67aa0f7bace66ffb614906124ed50d59daffectedc96adff95619178e2118925578343ad54857c80c to < 45e60747a9db2307929260d9aa9c1c6cbb70ee77affectedc96adff95619178e2118925578343ad54857c80c to < bb187146c7e5c666874784e4f3fc1bc5126e6e92affectedc96adff95619178e2118925578343ad54857c80c to < fee10655709c5c597e8e9f722f3035d9ea31ff3aaffected5.10.11 to < 5.10.273affected
Linux Linux
Default version status: affected
5.11affected0 to < 5.11unaffected5.10.273 to ≤ 5.10.*unaffected5.15.224 to ≤ 5.15.*unaffected6.1.191 to ≤ 6.1.*unaffected6.6.161 to ≤ 6.6.*unaffected6.12.115 to ≤ 6.12.*unaffected6.18.59 to ≤ 6.18.*unaffected7.2.13 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/a9283d006eef7e3b56f0f279a49bb63f6e5e61df ↗
- https://git.kernel.org/stable/c/497944d534ffb1be300365523030c7c6517cbbb6 ↗
- https://git.kernel.org/stable/c/a55d84907337580d91c0d54779d9d4b934633158 ↗
- https://git.kernel.org/stable/c/cff9bf34afde46c238189cc6f7690b7e35225df1 ↗
- https://git.kernel.org/stable/c/35354bf67aa0f7bace66ffb614906124ed50d59d ↗
- https://git.kernel.org/stable/c/45e60747a9db2307929260d9aa9c1c6cbb70ee77 ↗
- https://git.kernel.org/stable/c/bb187146c7e5c666874784e4f3fc1bc5126e6e92 ↗
- https://git.kernel.org/stable/c/fee10655709c5c597e8e9f722f3035d9ea31ff3a ↗