| From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001 |
| From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| To: <linux-cve-announce@vger.kernel.org> |
| Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> |
| Subject: CVE-2023-52628: netfilter: nftables: exthdr: fix 4-byte stack OOB write |
| |
| Description |
| =========== |
| |
| In the Linux kernel, the following vulnerability has been resolved: |
| |
| netfilter: nftables: exthdr: fix 4-byte stack OOB write |
| |
| If priv->len is a multiple of 4, then dst[len / 4] can write past |
| the destination array which leads to stack corruption. |
| |
| This construct is necessary to clean the remainder of the register |
| in case ->len is NOT a multiple of the register size, so make it |
| conditional just like nft_payload.c does. |
| |
| The bug was added in 4.1 cycle and then copied/inherited when |
| tcp/sctp and ip option support was added. |
| |
| Bug reported by Zero Day Initiative project (ZDI-CAN-21950, |
| ZDI-CAN-21951, ZDI-CAN-21961). |
| |
| The Linux kernel CVE team has assigned CVE-2023-52628 to this issue. |
| |
| |
| Affected and fixed versions |
| =========================== |
| |
| Issue introduced in 4.1 with commit 49499c3e6e18b7677a63316f3ff54a16533dc28f and fixed in 4.19.316 with commit 28a97c43c9e32f437ebb8d6126f9bb7f3ca9521a |
| Issue introduced in 4.1 with commit 49499c3e6e18b7677a63316f3ff54a16533dc28f and fixed in 5.4.279 with commit cf39c4f77a773a547ac2bcf30ecdd303bb0c80cb |
| Issue introduced in 4.1 with commit 49499c3e6e18b7677a63316f3ff54a16533dc28f and fixed in 5.10.198 with commit a7d86a77c33ba1c357a7504341172cc1507f0698 |
| Issue introduced in 4.1 with commit 49499c3e6e18b7677a63316f3ff54a16533dc28f and fixed in 5.15.132 with commit 1ad7b189cc1411048434e8595ffcbe7873b71082 |
| Issue introduced in 4.1 with commit 49499c3e6e18b7677a63316f3ff54a16533dc28f and fixed in 6.1.54 with commit d9ebfc0f21377690837ebbd119e679243e0099cc |
| Issue introduced in 4.1 with commit 49499c3e6e18b7677a63316f3ff54a16533dc28f and fixed in 6.5.4 with commit c8f292322ff16b9a2272a67de396c09a50e09dce |
| Issue introduced in 4.1 with commit 49499c3e6e18b7677a63316f3ff54a16533dc28f and fixed in 6.6 with commit fd94d9dadee58e09b49075240fe83423eb1dcd36 |
| |
| Please see https://www.kernel.org for a full list of currently supported |
| kernel versions by the kernel community. |
| |
| Unaffected versions might change over time as fixes are backported to |
| older supported kernel versions. The official CVE entry at |
| https://cve.org/CVERecord/?id=CVE-2023-52628 |
| will be updated if fixes are backported, please check that for the most |
| up to date information about this issue. |
| |
| |
| Affected files |
| ============== |
| |
| The file(s) affected by this issue are: |
| net/netfilter/nft_exthdr.c |
| |
| |
| Mitigation |
| ========== |
| |
| The Linux kernel CVE team recommends that you update to the latest |
| stable kernel version for this, and many other bugfixes. Individual |
| changes are never tested alone, but rather are part of a larger kernel |
| release. Cherry-picking individual commits is not recommended or |
| supported by the Linux kernel community at all. If however, updating to |
| the latest release is impossible, the individual changes to resolve this |
| issue can be found at these commits: |
| https://git.kernel.org/stable/c/28a97c43c9e32f437ebb8d6126f9bb7f3ca9521a |
| https://git.kernel.org/stable/c/cf39c4f77a773a547ac2bcf30ecdd303bb0c80cb |
| https://git.kernel.org/stable/c/a7d86a77c33ba1c357a7504341172cc1507f0698 |
| https://git.kernel.org/stable/c/1ad7b189cc1411048434e8595ffcbe7873b71082 |
| https://git.kernel.org/stable/c/d9ebfc0f21377690837ebbd119e679243e0099cc |
| https://git.kernel.org/stable/c/c8f292322ff16b9a2272a67de396c09a50e09dce |
| https://git.kernel.org/stable/c/fd94d9dadee58e09b49075240fe83423eb1dcd36 |
