| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <2024110937-CVE-2024-50251-66dc@gregkh> Date: Sat, 9 Nov 2024 11:15:59 +0100 From: Greg Kroah-Hartman <gregkh@...uxfoundation.org> To: linux-cve-announce@...r.kernel.org Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org> Subject: CVE-2024-50251: netfilter: nft_payload: sanitize offset and length before calling skb_checksum() Description =========== In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_payload: sanitize offset and length before calling skb_checksum() If access to offset + length is larger than the skbuff length, then skb_checksum() triggers BUG_ON(). skb_checksum() internally subtracts the length parameter while iterating over skbuff, BUG_ON(len) at the end of it checks that the expected length to be included in the checksum calculation is fully consumed. The Linux kernel CVE team has assigned CVE-2024-50251 to this issue. Affected and fixed versions =========================== Issue introduced in 4.5 with commit 7ec3f7b47b8d and fixed in 4.19.323 with commit a661ed364ae6 Issue introduced in 4.5 with commit 7ec3f7b47b8d and fixed in 5.4.285 with commit ac7df3fc80fc Issue introduced in 4.5 with commit 7ec3f7b47b8d and fixed in 5.10.229 with commit e3e608cbad37 Issue introduced in 4.5 with commit 7ec3f7b47b8d and fixed in 5.15.171 with commit b1d2de8a669f Issue introduced in 4.5 with commit 7ec3f7b47b8d and fixed in 6.1.116 with commit d3217323525f Issue introduced in 4.5 with commit 7ec3f7b47b8d and fixed in 6.6.60 with commit 0ab3be58b45b Issue introduced in 4.5 with commit 7ec3f7b47b8d and fixed in 6.11.7 with commit c43e0ea848e7 Issue introduced in 4.5 with commit 7ec3f7b47b8d and fixed in 6.12-rc6 with commit d5953d680f7e Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2024-50251 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: net/netfilter/nft_payload.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/a661ed364ae6ae88c2fafa9ddc27df1af2a73701 https://git.kernel.org/stable/c/ac7df3fc80fc82bcc3b1e8f6ebc0d2c435d0c534 https://git.kernel.org/stable/c/e3e608cbad376674d19a71ccd0d41804d9393f02 https://git.kernel.org/stable/c/b1d2de8a669fa14c499a385e056944d5352b3b40 https://git.kernel.org/stable/c/d3217323525f7596427124359e76ea0d8fcc9874 https://git.kernel.org/stable/c/0ab3be58b45b996764aba0187b46de19b3e58a72 https://git.kernel.org/stable/c/c43e0ea848e7b9bef7a682cbc5608022d6d29d7b https://git.kernel.org/stable/c/d5953d680f7e96208c29ce4139a0e38de87a57fe
Powered by blists - more mailing lists