In the Linux kernel, the following vulnerability has been resolved: e1000: fix OOB in e1000_tbi_should_accept() In e1000_tbi_should_accept() we read the last byte of the frame via 'data[length - 1]…
Critical CVSS 9.1
Summary
In the Linux kernel, the following vulnerability has been resolved: e1000: fix OOB in e1000_tbi_should_accept() In e1000_tbi_should_accept() we read the last byte of the frame via 'data[length - 1]' to evaluate the TBI workaround. If the descriptor- reported length is zero or larger than the actual RX buffer size, this read goes out of bounds and can hit unrelated slab objects. The issue is observed from the NAPI receive path (e1000_clean_rx_irq): ============================================…
In-depth triage · Auto channel
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Affected products
- :
Sources
- NVD DATABASE
Original Links
- https://git.kernel.org/stable/c/26c8bebc2f25288c2bcac7bc0a7662279a0e817c Patch
- https://git.kernel.org/stable/c/278b7cfe0d4da7502c7fd679b15032f014c92892 Patch
- https://git.kernel.org/stable/c/2c4c0c09f9648ba766d399917d420d03e7b3e1f8 Patch
- https://git.kernel.org/stable/c/4ccfa56f272241e8d8e2c38191fdbb03df489d80 Patch
- https://git.kernel.org/stable/c/9c72a5182ed92904d01057f208c390a303f00a0f Patch
- https://git.kernel.org/stable/c/ad7a2a45e2417ac54089926b520924f8f0d91aea Patch
- https://git.kernel.org/stable/c/ee7c125fb3e8b04dd46510130b9fc92380e5d578 Patch
Timeline
- nvd_ingest NVD