In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
eth: nfp: drop the replaced rule from the list when reprogramming fails<\/p>\n
nfp_net_fs_add() replaces an existing rule by deleting it from the
\nhardware, decrementing nn->fs.count and programming the new one. If
\nnfp_net_fs_add_hw() fails the old entry stays on nn->fs.list – only the
\nsuccess path reaches list_replace() – so the list is one longer than
\nnn->fs.count, and it advertises a rule whose hardware entry has already
\nbeen torn down.<\/p>\n
nn->fs.count is what ETHTOOL_GRXCLSRLCNT reports, so userspace then sizes
\nits buffer one entry short of what the GRXCLSRLALL walk wants to write.
\nThat used to overwrite one u32 past the allocation; since the walk is
\nbounded it is a permanent -EMSGSIZE instead, as nothing ever resyncs the
\ncounter.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
eth: nfp: drop the replaced rule from the list when reprogramming fails<\/p>\n
nfp_net_fs_add() replaces an existing rule by deleting it <\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-29183","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/29183","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=29183"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=29183"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=29183"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}