Description (CNA)
In the Linux kernel, the following vulnerability has been resolved: flow_dissector: avoid u16 truncation of hlen in bpf_flow_dissect() bpf_flow_dissect() sanitizes the offsets returned by the BPF program with clamp_t(u16, ..., hlen). If hlen is bigger than 65535, the upper bound is truncated before the comparison. For instance, with hlen == 65536, both nhoff and thoff are forced to zero, even if the program returned sane values. This is the same class of bug as the one fixed in commit 99bda1ecbd56 ("flow_dissector: avoid u16 truncation of skb->len when computing thoff"). That fix does not cover the BPF path, because __skb_flow_dissect() returns early when a BPF flow dissector handles the packet. struct bpf_flow_keys stores nhoff and thoff as u16, so cap hlen to U16_MAX before clamping. Found by sashiko while reviewing the commit above.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Linux / Linux | affected d58e468b1112dcd1d5193c0a89ff9f98b5a3e8b9 before c44c02c930c6583b235a1937c69ff716c4bb4514; affected d58e468b1112dcd1d5193c0a89ff9f98b5a3e8b9 before 3fb5ad2951a6df92c98f4f06cd70f20c50a2eb2a; affected d58e468b1112dcd1d5193c0a89ff9f98b5a3e8b9 before cc18eb0e9941162c03f03f411ed7f6c339d91fa0; affected d58e468b1112dcd1d5193c0a89ff9f98b5a3e8b9 before 61b43a51a55929ec040bee3ea51af2121b956d05; affected d58e468b1112dcd1d5193c0a89ff9f98b5a3e8b9 before f202578efc738b883cfa04889eb97328914265a7 |
| Linux / Linux | affected 4.20; unaffected 0 before 4.20; unaffected 6.6.160 through 6.6.*; unaffected 6.12.113 through 6.12.*; unaffected 6.18.57 through 6.18.*; unaffected 7.2.11 through 7.2.*; unaffected 7.3 through * |
CWE
No CWE identifiers supplied.
References
- https://git.kernel.org/stable/c/c44c02c930c6583b235a1937c69ff716c4bb4514
- https://git.kernel.org/stable/c/3fb5ad2951a6df92c98f4f06cd70f20c50a2eb2a
- https://git.kernel.org/stable/c/cc18eb0e9941162c03f03f411ed7f6c339d91fa0
- https://git.kernel.org/stable/c/61b43a51a55929ec040bee3ea51af2121b956d05
- https://git.kernel.org/stable/c/f202578efc738b883cfa04889eb97328914265a7