ipv4: icmp: validate reply type before using icmp_pointers
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 5.15.209, 6.1.175, 6.6.140, 6.12.86, 6.18.27, and 1 more
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: yes
- Technical impact: partial
Summary
In the Linux kernel, the following vulnerability has been resolved: ipv4: icmp: validate reply type before using icmp_pointers Extended echo replies use ICMP_EXT_ECHOREPLY as the outbound reply type. That value is outside the range covered by icmp_pointers[], which only describes the traditional ICMP types up to NR_ICMP_TYPES. Avoid consulting icmp_pointers[] for reply types outside that range, and use array_index_nospec() for the remaining in-range lookup. Normal ICMP replies keep their existing behavior unchanged.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: yes · Technical impact: partial
- Record last updated
Affected versions
- Linux Linux
From d329ea5bd8845f0b196bf41b18b6173340d6e0e4 · fixed in b3a88fc5ae024d43c5ecf653f3bbe837e4a6dc99; From d329ea5bd8845f0b196bf41b18b6173340d6e0e4 · fixed in 93df2af4f491de33827550b9d420f01808c0706b; From d329ea5bd8845f0b196bf41b18b6173340d6e0e4 · fixed in 92e7c209036dcc0e8ffdf806fdfd3645b263bea5; From d329ea5bd8845f0b196bf41b18b6173340d6e0e4 · fixed in bc64a66e0b9ad937d3d49934242ee62b01ba9a94; From d329ea5bd8845f0b196bf41b18b6173340d6e0e4 · fixed in c2178ff1c70ebfc2ab9651b230c58a34683db759; From d329ea5bd8845f0b196bf41b18b6173340d6e0e4 · fixed in d700c34a5d186b9ba0715bcb19e0ff80ffbfbfc1; From d329ea5bd8845f0b196bf41b18b6173340d6e0e4 · fixed in 67bf002a2d7387a6312138210d0bd06e3cf4879b
- Linux Linux
5.13
- KernelLinux
From 5.13.0 · fixed in 5.15.209; From 5.16.0 · fixed in 6.1.175; From 6.2.0 · fixed in 6.6.140; From 6.7.0 · fixed in 6.12.86; From 6.13.0 · fixed in 6.18.27; From 6.19.0 · fixed in 7.0.4
References 7
git.kernel.org
- stable/c/b3a88fc5ae024d43c5ecf653f3bbe837e4a6dc99
- stable/c/93df2af4f491de33827550b9d420f01808c0706b
- stable/c/92e7c209036dcc0e8ffdf806fdfd3645b263bea5
- stable/c/bc64a66e0b9ad937d3d49934242ee62b01ba9a94
- stable/c/c2178ff1c70ebfc2ab9651b230c58a34683db759
- stable/c/d700c34a5d186b9ba0715bcb19e0ff80ffbfbfc1
- stable/c/67bf002a2d7387a6312138210d0bd06e3cf4879b