In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ipv6: do not let ipv6_find_hdr() return an offset past the packet end<\/p>\n
ipv6_find_hdr() walks the extension header chain, skipping each header by
\nthe length that header itself declares. ipv6_optlen() returns up to 2048,
\nand the skip is never checked against skb->len, so the offset stored in
\n*offset can point past the end of the packet.<\/p>\n
openvswitch installs that offset as the transport header, and
\nupdate_ipv6_checksum() then reads and writes the transport checksum field
\nout of bounds:<\/p>\n
BUG: KASAN: slab-use-after-free in inet_proto_csum_replace16+0x445\/0x470
\n Read of size 2 at addr ffff88810b754b06 by task ovs_ipv6_oob\/629
\n CPU: 4 UID: 1000 PID: 629 Comm: ovs_ipv6_oob Tainted: G N 7.3.0-rc3+ #348
\n Call Trace:
\n inet_proto_csum_replace16+0x445\/0x470
\n set_ipv6_addr+0x3dd\/0x460
\n do_execute_actions+0x6a3d\/0x7c40
\n ovs_execute_actions+0xfd\/0x480
\n ovs_packet_cmd_execute+0xc38\/0xf20
\n genl_rcv_msg+0x59e\/0x870
\n netlink_rcv_skb+0x18b\/0x450
\n genl_rcv+0x2d\/0x40
\n netlink_unicast+0x6bc\/0xa20<\/p>\n
The buggy address belongs to the object at ffff88810b754980
\n which belongs to the cache skbuff_small_head of size 704
\n The buggy address is located 390 bytes inside of
\n freed 704-byte region [ffff88810b754980, ffff88810b754c40)<\/p>\n
Other callers use that offset too, so bound it here rather than in one
\ncaller.<\/p>\n
Reject a header whose declared length does not fit in the packet.
\nipv6_find_hdr() already fails with -EBADMSG on a malformed chain, so this
\nadds no new failure mode.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ipv6: do not let ipv6_find_hdr() return an offset past the packet end<\/p>\n
ipv6_find_hdr() walks the extension header chain, skipping e<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-41004","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/41004","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=41004"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=41004"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=41004"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}