rxrpc: Fix integer overflow in rxgk_verify_response()
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 6.18.23, 6.19.13
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: yes
- Technical impact: total
Summary
In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix integer overflow in rxgk_verify_response() In rxgk_verify_response(), there's a potential integer overflow due to rounding up token_len before checking it, thereby allowing the length check to be bypassed. Fix this by checking the unrounded value against len too (len is limited as the response must fit in a single UDP packet).
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: yes · Technical impact: total
- Record last updated
Affected versions
- Linux Linux
From 9d1d2b59341f58126a69b51f9f5f8ccb9f12e54a · fixed in 1f864d9daaf622aeaa774404fd51e7d6a435b046; From 9d1d2b59341f58126a69b51f9f5f8ccb9f12e54a · fixed in c1e242beb6b1efc3c286f617e8d940c8fbf2ed41; From 9d1d2b59341f58126a69b51f9f5f8ccb9f12e54a · fixed in 699e52180f4231c257821c037ed5c99d5eb0edb8
- Linux Linux
6.16
- KernelLinux
From 6.16.0 · fixed in 6.18.23; From 6.19.0 · fixed in 6.19.13