Vigie VulnDBEuropean-hosted Vulnerability DB
EN
Menu

netfilter: nf_conntrack_h323: Add protection for bmp length out of range (Linux Linux)

CVE-2024-26851
HIGH 7.5

En bref

Source
NVD
EPSS
EPSS 0.74 % · centile 55 ()
État
PUBLISHED
Publiée
Mise à jour
Attribuée par
Linux
Statut NVD
Modified

Rechercher sur…

Description

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_h323: Add protection for bmp length out of range UBSAN load reports an exception of BRK#5515 SHIFT_ISSUE:Bitwise shifts that are out of bounds for their data type. vmlinux get_bitmap(b=75) + 712 <net/netfilter/nf_conntrack_h323_asn1.c:0> vmlinux decode_seq(bs=0xFFFFFFD008037000, f=0xFFFFFFD008037018, level=134443100) + 1956 <net/netfilter/nf_conntrack_h323_asn1.c:592> vmlinux decode_choice(base=0xFFFFFFD0080370F0, level=23843636) + 1216 <net/netfilter/nf_conntrack_h323_asn1.c:814> vmlinux decode_seq(f=0xFFFFFFD0080371A8, level=134443500) + 812 <net/netfilter/nf_conntrack_h323_asn1.c:576> vmlinux decode_choice(base=0xFFFFFFD008037280, level=0) + 1216 <net/netfilter/nf_conntrack_h323_asn1.c:814> vmlinux DecodeRasMessage() + 304 <net/netfilter/nf_conntrack_h323_asn1.c:833> vmlinux ras_help() + 684 <net/netfilter/nf_conntrack_h323_main.c:1728> vmlinux nf_confirm() + 188 <net/netfilter/nf_conntrack_proto.c:137> Due to abnormal data in skb->data, the extension bitmap length exceeds 32 when decoding ras message then uses the length to make a shift operation. It will change into negative after several loop. UBSAN load could detect a negative shift as an undefined behaviour and reports exception. So we add the protection to avoid the length exceeding 32. Or else it will return out of range error and stop decoding.

Faiblesses (CWE)

Références

Scores

VersionScoreVecteurÉvalué par
CVSS 3.1HIGH 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HLinux
CVSS 3.1HIGH 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HNVD · 416baaa9-dc9f-4396-8d5f-8c081fb06d67 (Secondary)
CVSS 3.1MEDIUM 5.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HNVD · nvd@nist.gov (Primary)

Références européennes

Avis du CERT-FR

Configurations affectées (CPE NVD)

Produits affectés

ProduitVersions
Linux · Linuxaffected 5e35941d990123f155b02d5663e51a24f816b6f3 < 98db42191329c679f4ca52bec0b319689e1ad8cb ; affected 5e35941d990123f155b02d5663e51a24f816b6f3 < 4bafcc43baf7bcf93566394dbd15726b5b456b7a ; affected 5e35941d990123f155b02d5663e51a24f816b6f3 < ccd1108b16ab572d9bf635586b0925635dbd6bbc ; affected 5e35941d990123f155b02d5663e51a24f816b6f3 < b3c0f553820516ad4b62a9390ecd28d6f73a7b13 ; affected 5e35941d990123f155b02d5663e51a24f816b6f3 < 39001e3c42000e7c2038717af0d33c32319ad591 ; affected 5e35941d990123f155b02d5663e51a24f816b6f3 < 014a807f1cc9c9d5173c1cd935835553b00d211c
Linux · Linuxaffected 2.6.17 ; unaffected 0 < 2.6.17 ; unaffected 4.19.310 ≤ 4.19.* ; unaffected 5.4.272 ≤ 5.4.* ; unaffected 5.10.213 ≤ 5.10.* ; unaffected 5.15.152 ≤ 5.15.*

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD