Описание
In the Linux kernel, the following vulnerability has been resolved:
batman-adv: dat: ensure accessible eth_hdr proto field
When batadv_get_vid() accesses the proto field of the ethernet header, it
is not checking if the data itself is accessible. The caller is responsible
for it. But in contrast to other call sites, batadv_dat_get_vid() and its
caller didn't make sure this is true. This could have caused an
out-of-bounds access.
A flaw was found in the Linux kernel's batman-adv (Better Approach To Mobile Ad-hoc Networking - Advanced) module. An attacker, by sending specially crafted network packets, could trigger an out-of-bounds memory access in the batadv_get_vid() function. This occurs because the function fails to verify the accessibility of the ethernet header's protocol field, potentially leading to system instability or information disclosure.
Отчет
A moderate-impact out-of-bounds read flaw was found in the Linux kernel's batman-adv (Better Approach To Mobile Ad-hoc Networking - Advanced) Distributed ARP Table (DAT) implementation. When processing specially crafted network packets, the batadv_get_vid() function accesses the protocol field of the Ethernet header without first verifying that the header data is accessible, which could cause an out-of-bounds memory access. Successful exploitation could crash the kernel, resulting in a denial of service, or potentially expose sensitive information. Red Hat rated this flaw Moderate severity (CVSS 5.5), which differs from the CVE.org score of Important (8.1): the Red Hat CVSS vector scores the issue with a local attack vector and availability-only impact, whereas the CVE.org vector uses an adjacent-network attack vector with high confidentiality and availability impact. All Red Hat products in scope for this flaw - Red Hat Enterprise Linux 6, 7, 8, 9, and 10 (kernel and kernel-rt) and Red Hat In-Vehicle OS - are not affected because the vulnerable code is not present in the shipped kernel builds.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | kernel | Not affected | ||
| Red Hat Enterprise Linux 6 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 9 | kernel | Not affected | ||
| Red Hat Enterprise Linux 9 | kernel-rt | Not affected |
Показывать по
Дополнительная информация
Статус:
EPSS
5.5 Medium
CVSS3
Связанные уязвимости
In the Linux kernel, the following vulnerability has been resolved: batman-adv: dat: ensure accessible eth_hdr proto field When batadv_get_vid() accesses the proto field of the ethernet header, it is not checking if the data itself is accessible. The caller is responsible for it. But in contrast to other call sites, batadv_dat_get_vid() and its caller didn't make sure this is true. This could have caused an out-of-bounds access.
In the Linux kernel, the following vulnerability has been resolved: batman-adv: dat: ensure accessible eth_hdr proto field When batadv_get_vid() accesses the proto field of the ethernet header, it is not checking if the data itself is accessible. The caller is responsible for it. But in contrast to other call sites, batadv_dat_get_vid() and its caller didn't make sure this is true. This could have caused an out-of-bounds access.
In the Linux kernel, the following vulnerability has been resolved: b ...
EPSS
5.5 Medium
CVSS3