In the Linux kernel, the following vulnerability has been resolved: netfilter: complete validation of user input In my recent commit, I missed that do_replace() handlers use copy_from_sockptr() (which I fixed), followed by unsafe copy_from_sockptr_offset() calls. In all functions, we can perform the @optlen validation before even calling xt_alloc_table_info() with the following check: if ((u64)optlen < (u64)tmp.size + sizeof(tmp)) return -EINVAL;
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
Debian | 12 | all | linux | < 6.1.90-1 | linux_6.1.90-1_all.deb |
Debian | 11 | all | linux | < 5.10.216-1 | linux_5.10.216-1_all.deb |
Debian | 999 | all | linux | < 6.8.9-1 | linux_6.8.9-1_all.deb |
Debian | 13 | all | linux | < 6.8.9-1 | linux_6.8.9-1_all.deb |