In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: dccp: copy entire header to stack buffer, not just basic one Eric Dumazet says: nf_conntrack_dccp_packet() has an unique: dh = skb_header_pointer(skb, dataoff, sizeof(_dh), &_dh); And nothing more is 'pulled' from the packet, depending on the content. dh->dccph_doff, and/or dh->dccph_x ...) So dccp_ack_seq() is happily reading stuff past the _dh buffer. BUG: KASAN: stack-out-of-bounds in nf_conntrack_dccp_packet+0x1134/0x11c0 Read of size 4 at addr ffff000128f66e0c by task syz-executor.2/29371 [..] Fix...
In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: dccp: copy entire header to stack buffer, not just basic one Eric Dumazet says: nf_conntrack_dccp_packet() has an unique: dh = skb_header_pointer(skb, dataoff, sizeof(_dh), &_dh); And nothing more is 'pulled' from the packet, depending on the content. dh->dccph_doff, and/or dh->dccph_x ...) So dccp_ack_seq() is happily reading stuff past the _dh buffer. BUG: KASAN: stack-out-of-bounds in nf_conntrack_dccp_packet+0x1134/0x11c0 Read of size 4 at addr ffff000128f66e0c by task syz-executor.2/29371 [..] Fix...
Linux Linux, linux kernel의 현재 전체 버전이 공식 영향 범위(Linux Linux, linux kernel >= 2bc780499aa33311ec0f3e42624dfaa7be0ade5e < 337fdce450637ea663bc816edc2ba81e5cdad02e, >= 2bc780499aa33311ec0f3e42624dfaa7be0ade5e < 9bdcda7abaf22f6453e5b5efb7eb4e524095d5d8, >= 2bc780499aa33311ec0f3e42624dfaa7be0ade5e < c052797ac36813419ad3bfa54cb8615db4b41f15, >= 2bc780499aa33311ec0f3e42624dfaa7be0ade5e < 5c618daa5038712c4a4ef8923905a2ea1b8836a1, >= 2bc780499aa33311ec0f3e42624dfaa7be0ade5e < 26bd1f210d3783a691052c51d76bb8a8bbd24c67, >= 2bc780499aa33311ec0f3e42624dfaa7be0ade5e < 8c0980493beed3a80d6329c44ab293dc8c032927, >= 2bc780499aa33311ec0f3e42624dfaa7be0ade5e < ff0a3a7d52ff7282dbd183e7fc29a1fe386b0c30, >= 2.6.26, >= 2.6.26 < 5.4.251, >= 5.5 < 5.10.188, >= 5.11 < 5.15.121, >= 5.16 < 6.1.39, >= 6.2 < 6.3.13, >= 6.4 < 6.4.4)에 포함되는지 확인합니다. OS를 선택하면 해당 OS의 제품·패키지·KB·APAR 확인 명령만 표시됩니다.
조치방안
구조화된 수정 버전 값(5.4.251, 5.10.188, 5.15.121, 6.1.39, 6.3.13, 6.4.4)은 참고용입니다. 공급사 공식 보안 권고에서 제품·에디션·설치 방식별 수정 기준을 확인한 뒤 적용합니다.
조치 후 확인사항
패치 후 같은 명령으로 전체 버전을 다시 확인해 Linux Linux, linux kernel 5.4.251, 5.10.188, 5.15.121, 6.1.39, 6.3.13, 6.4.4 기준을 충족하는지 확인합니다. 이어서 메모리 손상 관련 오류·공격 흔적이 새로 발생하지 않는지 확인합니다.
