In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: exthdr: fix 4-byte stack OOB write If priv->len is a multiple of 4, then dst[len / 4] can write past the destination array which leads to stack corruption. This construct is necessary to clean the remainder of the register in case ->len is NOT a multiple of the register size, so make it conditional just like nft_payload.c does. The bug was added in 4.1 cycle and then copied/inherited when tcp/sctp and ip option support was added. Bug reported by Zero Day Initiative project (ZDI-CAN-21950, ZDI-CAN-21951, ZDI-CAN-21961).
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
Debian | 12 | all | linux | < 6.1.55-1 | linux_6.1.55-1_all.deb |
Debian | 11 | all | linux | < 5.10.205-1 | linux_5.10.205-1_all.deb |
Debian | 999 | all | linux | < 6.5.6-1 | linux_6.5.6-1_all.deb |
Debian | 13 | all | linux | < 6.5.6-1 | linux_6.5.6-1_all.deb |