net: hsr: fix potential OOB access in supervision frame handling
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 6.1.176, 6.6.143, 6.12.93, 6.18.35, 7.0.12
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: yes
- Technical impact: total
Summary
In the Linux kernel, the following vulnerability has been resolved: net: hsr: fix potential OOB access in supervision frame handling Ensure the entire TLV header is linearized before access by adding sizeof(struct hsr_sup_tlv) to the pskb_may_pull() calls. Without this, a truncated frame could cause an out-of-bounds access.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: yes · Technical impact: total
- Record last updated
Affected versions
- Linux Linux
From eafaa88b3eb7f28aecb222281655473431d3ef2e · fixed in 09a37dca090c55ffb1a33f52d8667f1c2367ef48; From eafaa88b3eb7f28aecb222281655473431d3ef2e · fixed in a4b64f3e9c7b8259f7dd251a0313420ba7c01852; From eafaa88b3eb7f28aecb222281655473431d3ef2e · fixed in 71c986c0ba45b7dc574fae27c83e7b6671556f37; From eafaa88b3eb7f28aecb222281655473431d3ef2e · fixed in fbd0662f9c9a66e8cc3df3099cca8ed6d3837cc7; From eafaa88b3eb7f28aecb222281655473431d3ef2e · fixed in 78607a6854a22a2502f68092202e75a39af4865d; From eafaa88b3eb7f28aecb222281655473431d3ef2e · fixed in f229426072fc865654a60978bb7fda790a051ff3
- Linux Linux
5.16
- KernelLinux
From 5.16.0 · fixed in 6.1.176; From 6.2.0 · fixed in 6.6.143; From 6.7.0 · fixed in 6.12.93; From 6.13.0 · fixed in 6.18.35; From 6.19.0 · fixed in 7.0.12