In the Linux kernel, the following vulnerability has been resolved: net/openvswitch: check Ethernet header length in key_extract() When a packet arrives on an ARPHRD_NONE device (e.g. TUN), ovs_flo…
Info
Summary
In the Linux kernel, the following vulnerability has been resolved: net/openvswitch: check Ethernet header length in key_extract() When a packet arrives on an ARPHRD_NONE device (e.g. TUN), ovs_flow_key_extract() trusts the user-provided skb->protocol field: if it is ETH_P_TEB, the packet is classified as MAC_PROTO_ETHERNET and key_extract() is called without ensuring the skb has ETH_HLEN (14) bytes of linear data. key_extract() unconditionally pulls 2 * ETH_ALEN bytes for MAC addresses and p…
In-depth triage
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Sources
- NVD DATABASE
Original Links
- https://git.kernel.org/stable/c/0b60b55652ba772b173dddc63f3851e1d2dd5927
- https://git.kernel.org/stable/c/81f9b09f0ea3ba9ab966dd17e9f32625a14555e9
- https://git.kernel.org/stable/c/831471718f6e19aed1a330b03b53190a90e06466
- https://git.kernel.org/stable/c/9b8cfbb58b85bfa7a78fac47fdc77396cd01f699
- https://git.kernel.org/stable/c/a8139285c8925efe59af28a9169bb2fda91bff15
- https://git.kernel.org/stable/c/cf6f8b29befb92173659bcef6a441d274947bfae
- https://git.kernel.org/stable/c/d8bea341b183190ce6c055ab0e64ab78eb9a7290
- https://git.kernel.org/stable/c/e85278afd4890dd190ba3c7a1b1a712b801c9fe1
Timeline
- nvd_ingest NVD