In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
netfilter: nf_conntrack_irc: fix parse_dcc() off-by-one OOB read<\/p>\n
parse_dcc() treats data_end as an inclusive end pointer, but its only
\ncaller passes data_limit = ib_ptr + datalen, which points one past the
\nlast valid byte.<\/p>\n
The newline search loop iterates while tmp <= data_end, so when no
\nnewline is present, *tmp is read at tmp == data_end, one byte beyond
\nthe region filled by skb_header_pointer().<\/p>\n
irc_buffer is kmalloc'd as MAX_SEARCH_SIZE + 1 bytes and datalen is
\ncapped at MAX_SEARCH_SIZE, so the stray read does not fault. The byte
\nis uninitialized or stale; if it contains an ASCII digit, simple_strtoul
\nwill consume it and produce a wrong DCC IP or port in the conntrack
\nexpectation. The extra allocation byte is also a fragile guard: if the
\ncap or allocation size changes, this becomes a real out-of-bounds read.<\/p>\n
Change the loop and its post-loop check to use strict less-than,
\nconsistent with the caller's exclusive-end convention. Update the
\nfunction comment accordingly.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
netfilter: nf_conntrack_irc: fix parse_dcc() off-by-one OOB read<\/p>\n
parse_dcc() treats data_end as an inclusive end pointer, but its <\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-12298","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/12298","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=12298"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=12298"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=12298"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}