In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
netfilter: flowtable: avoid num_encaps underflow on bridge VLAN untag<\/p>\n
The DEV_PATH_BR_VLAN_UNTAG case post-decrements info->num_encaps
\ninside WARN_ON_ONCE(). num_encaps is u8, so if it’s already 0 the
\ndecrement still happens and wraps it to 255. The break only leaves
\nthe inner switch — a later path entry can set info->indev back to
\na real device, and we end up returning with num_encaps == 255.<\/p>\n
nft_dev_forward_path() then walks info.encap[] (size 2) up to
\nnum_encaps, which means an OOB stack read and a bogus count copied
\ninto the route descriptor.<\/p>\n
Should only happen on a malformed bridge path stack, hence the WARN,
\nbut worth handling sanely. Move the decrement out of the WARN.<\/p>\n
[ While at this, remove the WARN_ON_ONCE since this can only happen
\n with a buggy bridge path stack –pablo ].<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
netfilter: flowtable: avoid num_encaps underflow on bridge VLAN untag<\/p>\n
The DEV_PATH_BR_VLAN_UNTAG case post-decrements info->num_en<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-12314","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/12314","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=12314"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=12314"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=12314"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}