In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ipv6: fix Route Information option length validation<\/p>\n
rt6_route_rcv() validates the Route Information option (RFC 4191) length
\nagainst the prefix length, but both checks are off by one.<\/p>\n
rinfo->length is the ND option length in units of 8 octets and it
\n*includes* the 8-byte option header, so an option carrying N bytes of
\nprefix has length == 1 + N\/8. RFC 4191 section 2.3 requires length 3
\nwhen Prefix Length is greater than 64, and 2 or 3 when it is greater
\nthan 0. The code accepts length >= 2 and length >= 1 respectively.<\/p>\n
ipv6_addr_prefix() then copies prefix_len\/8 bytes out of rinfo->prefix,
\nso a Router Advertisement with (prefix_len=128, length=2) or
\n(prefix_len=64, length=1) makes the kernel read up to 8 bytes past the
\nend of the option. Those bytes end up in the prefix of the route that
\ngets installed, so they are visible to userspace:<\/p>\n
# RA with a Route Information option (prefix_len=128, length=2)
\n # followed by a source link-layer address option, 01 01 de ad be ef ca fe
\n $ ip -6 route show
\n 2001:db8:dead:beef:101:dead:beef:cafe via fe80::1234 dev veth0 proto ra
\n ^^^^^^^^^^^^^^^^^^ the next option, read out of bounds<\/p>\n
When the Route Information option is the last one in the packet, those
\neight bytes come from the skb tail room instead.<\/p>\n
Reject the option lengths RFC 4191 does not allow.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ipv6: fix Route Information option length validation<\/p>\n
rt6_route_rcv() validates the Route Information option (RFC 4191) length
\nagai<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-11207","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/11207","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=11207"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=11207"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=11207"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}