In the Linux kernel, the following vulnerability has been resolved: ipv6: fix Route Information option length validation rt6_route_rcv() validates the Route Information option (RFC 4191) length aga…
Info
Summary
In the Linux kernel, the following vulnerability has been resolved: ipv6: fix Route Information option length validation rt6_route_rcv() validates the Route Information option (RFC 4191) length against the prefix length, but both checks are off by one. rinfo->length is the ND option length in units of 8 octets and it *includes* the 8-byte option header, so an option carrying N bytes of prefix has length == 1 + N/8. RFC 4191 section 2.3 requires length 3 when Prefix Length is greater than 64…
In-depth triage
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Sources
- NVD DATABASE
Original Links
- https://git.kernel.org/stable/c/0b9e02f3bd31c888f2ccdc0ca08e546d6abe9c4d
- https://git.kernel.org/stable/c/2f6f94eda12430fb41b24b44a71e2ea4e93561d7
- https://git.kernel.org/stable/c/3b2231e358d26e3aec5d8040b1fb777af03c5f05
- https://git.kernel.org/stable/c/7309529f257ae18e72112ef9f614edfd6df229bb
- https://git.kernel.org/stable/c/7eac87396c44a312be457ef41d4c5687883be9a2
- https://git.kernel.org/stable/c/d1ad8fb2ac6a1afb71dc22d9ae8efb4dda96c824
- https://git.kernel.org/stable/c/da64ed1f346ba84df574d6469fa2e422b2511719
- https://git.kernel.org/stable/c/ff3cb05289b8a4ef95fa7ea14c7d34818359edbb
Timeline
- nvd_ingest NVD