net: systemport: Fix buffer overflow in bcm_sysport_get_stats()
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 6.6.160, 6.12.113, 6.18.56, 7.2.10
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
In the Linux kernel, the following vulnerability has been resolved: net: systemport: Fix buffer overflow in bcm_sysport_get_stats() When running on SYSTEMPORT Lite, certain statistics are unsupported and skipped during bcm_sysport_get_stats(). The variable 'j' tracks the compacted index into the destination data buffer, whereas 'i' iterates over all elements in bcm_sysport_gstrings_stats. Because the buffer allocated by ethtool is sized only according to bcm_sysport_get_sset_count(), storing values at data[i] instead of data[j] writes past the allocated array bounds, leading to memory corruption. Fix this by writing to data[j] instead of data[i].
Timeline
- CVE published
- Record last updated
Affected versions
- Linux Linux
From 10377ba7673d19e28d92846955d51f49acd25c35 · fixed in 96a2b042051553df0d9f03b518dd3b7105b36935; From 10377ba7673d19e28d92846955d51f49acd25c35 · fixed in 29d1d35ad5ad379a904263ea1cd4ba1d71cd965f; From 10377ba7673d19e28d92846955d51f49acd25c35 · fixed in 96d8b26be5bc451188acdcee055948da45adbde0; From 10377ba7673d19e28d92846955d51f49acd25c35 · fixed in faba9fdde480356f4a1d3b1a5713b7b354858a1c; From 10377ba7673d19e28d92846955d51f49acd25c35 · fixed in eb7b84af0ec5c71b4920e999611b466b3784496c
- Linux Linux
4.14
- KernelLinux
From 4.14.0 · fixed in 6.6.160; From 6.7.0 · fixed in 6.12.113; From 6.13.0 · fixed in 6.18.56; From 6.19.0 · fixed in 7.2.10