| { |
| "containers": { |
| "cna": { |
| "providerMetadata": { |
| "orgId": "f4215fc3-5b6b-47ff-a258-f7189bd81038" |
| }, |
| "descriptions": [ |
| { |
| "lang": "en", |
| "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: bridge: replace physindev with physinif in nf_bridge_info\n\nAn skb can be added to a neigh->arp_queue while waiting for an arp\nreply. Where original skb's skb->dev can be different to neigh's\nneigh->dev. For instance in case of bridging dnated skb from one veth to\nanother, the skb would be added to a neigh->arp_queue of the bridge.\n\nAs skb->dev can be reset back to nf_bridge->physindev and used, and as\nthere is no explicit mechanism that prevents this physindev from been\nfreed under us (for instance neigh_flush_dev doesn't cleanup skbs from\ndifferent device's neigh queue) we can crash on e.g. this stack:\n\narp_process\n neigh_update\n skb = __skb_dequeue(&neigh->arp_queue)\n neigh_resolve_output(..., skb)\n ...\n br_nf_dev_xmit\n br_nf_pre_routing_finish_bridge_slow\n skb->dev = nf_bridge->physindev\n br_handle_frame_finish\n\nLet's use plain ifindex instead of net_device link. To peek into the\noriginal net_device we will use dev_get_by_index_rcu(). Thus either we\nget device and are safe to use it or we don't get it and drop skb." |
| } |
| ], |
| "affected": [ |
| { |
| "product": "Linux", |
| "vendor": "Linux", |
| "defaultStatus": "unaffected", |
| "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", |
| "programFiles": [ |
| "include/linux/netfilter_bridge.h", |
| "include/linux/skbuff.h", |
| "net/bridge/br_netfilter_hooks.c", |
| "net/bridge/br_netfilter_ipv6.c", |
| "net/ipv4/netfilter/nf_reject_ipv4.c", |
| "net/ipv6/netfilter/nf_reject_ipv6.c" |
| ], |
| "versions": [ |
| { |
| "version": "c4e70a87d975d1f561a00abfe2d3cefa2a486c95", |
| "lessThan": "7ae19ee81ca56b13c50a78de6c47d5b8fdc9d97b", |
| "status": "affected", |
| "versionType": "git" |
| }, |
| { |
| "version": "c4e70a87d975d1f561a00abfe2d3cefa2a486c95", |
| "lessThan": "9325e3188a9cf3f69fc6f32af59844bbc5b90547", |
| "status": "affected", |
| "versionType": "git" |
| }, |
| { |
| "version": "c4e70a87d975d1f561a00abfe2d3cefa2a486c95", |
| "lessThan": "544add1f1cfb78c3dfa3e6edcf4668f6be5e730c", |
| "status": "affected", |
| "versionType": "git" |
| }, |
| { |
| "version": "c4e70a87d975d1f561a00abfe2d3cefa2a486c95", |
| "lessThan": "9874808878d9eed407e3977fd11fee49de1e1d86", |
| "status": "affected", |
| "versionType": "git" |
| } |
| ] |
| }, |
| { |
| "product": "Linux", |
| "vendor": "Linux", |
| "defaultStatus": "affected", |
| "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", |
| "programFiles": [ |
| "include/linux/netfilter_bridge.h", |
| "include/linux/skbuff.h", |
| "net/bridge/br_netfilter_hooks.c", |
| "net/bridge/br_netfilter_ipv6.c", |
| "net/ipv4/netfilter/nf_reject_ipv4.c", |
| "net/ipv6/netfilter/nf_reject_ipv6.c" |
| ], |
| "versions": [ |
| { |
| "version": "4.2", |
| "status": "affected" |
| }, |
| { |
| "version": "0", |
| "lessThan": "4.2", |
| "status": "unaffected", |
| "versionType": "semver" |
| }, |
| { |
| "version": "6.1.75", |
| "lessThanOrEqual": "6.1.*", |
| "status": "unaffected", |
| "versionType": "semver" |
| }, |
| { |
| "version": "6.6.14", |
| "lessThanOrEqual": "6.6.*", |
| "status": "unaffected", |
| "versionType": "semver" |
| }, |
| { |
| "version": "6.7.2", |
| "lessThanOrEqual": "6.7.*", |
| "status": "unaffected", |
| "versionType": "semver" |
| }, |
| { |
| "version": "6.8", |
| "lessThanOrEqual": "*", |
| "status": "unaffected", |
| "versionType": "original_commit_for_fix" |
| } |
| ] |
| } |
| ], |
| "cpeApplicability": [ |
| { |
| "nodes": [ |
| { |
| "operator": "OR", |
| "negate": false, |
| "cpeMatch": [ |
| { |
| "vulnerable": true, |
| "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", |
| "versionStartIncluding": "4.2", |
| "versionEndExcluding": "6.1.75" |
| }, |
| { |
| "vulnerable": true, |
| "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", |
| "versionStartIncluding": "4.2", |
| "versionEndExcluding": "6.6.14" |
| }, |
| { |
| "vulnerable": true, |
| "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", |
| "versionStartIncluding": "4.2", |
| "versionEndExcluding": "6.7.2" |
| }, |
| { |
| "vulnerable": true, |
| "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", |
| "versionStartIncluding": "4.2", |
| "versionEndExcluding": "6.8" |
| } |
| ] |
| } |
| ] |
| } |
| ], |
| "references": [ |
| { |
| "url": "https://git.kernel.org/stable/c/7ae19ee81ca56b13c50a78de6c47d5b8fdc9d97b" |
| }, |
| { |
| "url": "https://git.kernel.org/stable/c/9325e3188a9cf3f69fc6f32af59844bbc5b90547" |
| }, |
| { |
| "url": "https://git.kernel.org/stable/c/544add1f1cfb78c3dfa3e6edcf4668f6be5e730c" |
| }, |
| { |
| "url": "https://git.kernel.org/stable/c/9874808878d9eed407e3977fd11fee49de1e1d86" |
| } |
| ], |
| "title": "netfilter: bridge: replace physindev with physinif in nf_bridge_info", |
| "x_generator": { |
| "engine": "bippy-1.2.0" |
| } |
| } |
| }, |
| "cveMetadata": { |
| "assignerOrgId": "f4215fc3-5b6b-47ff-a258-f7189bd81038", |
| "cveID": "CVE-2024-35839", |
| "requesterUserId": "gregkh@kernel.org", |
| "serial": "1", |
| "state": "PUBLISHED" |
| }, |
| "dataType": "CVE_RECORD", |
| "dataVersion": "5.0" |
| } |
