In the Linux kernel, the following vulnerability has been resolved:
netfilter: nfconntrackh323: Add protection for bmp length out of range
UBSAN load reports an exception of BRK#5515 SHIFT_ISSUE:Bitwise shifts that are out of bounds for their data type.
vmlinux getbitmap(b=75) + 712 <net/netfilter/nf_conntrack_h323_asn1.c:0> vmlinux decodeseq(bs=0xFFFFFFD008037000, f=0xFFFFFFD008037018, level=134443100) + 1956 <net/netfilter/nf_conntrack_h323_asn1.c:592> vmlinux decodechoice(base=0xFFFFFFD0080370F0, level=23843636) + 1216 <net/netfilter/nf_conntrack_h323_asn1.c:814> vmlinux decodeseq(f=0xFFFFFFD0080371A8, level=134443500) + 812 <net/netfilter/nf_conntrack_h323_asn1.c:576> vmlinux decodechoice(base=0xFFFFFFD008037280, level=0) + 1216 <net/netfilter/nf_conntrack_h323_asn1.c:814> vmlinux DecodeRasMessage() + 304 <net/netfilter/nf_conntrack_h323_asn1.c:833> vmlinux rashelp() + 684 <net/netfilter/nf_conntrack_h323_main.c:1728> vmlinux nf_confirm() + 188 <net/netfilter/nf_conntrack_proto.c:137>
Due to abnormal data in skb->data, the extension bitmap length exceeds 32 when decoding ras message then uses the length to make a shift operation. It will change into negative after several loop. UBSAN load could detect a negative shift as an undefined behaviour and reports exception. So we add the protection to avoid the length exceeding 32. Or else it will return out of range error and stop decoding.
[
{
"id": "CVE-2024-26851-05d47bbc",
"target": {
"file": "net/netfilter/nf_conntrack_h323_asn1.c",
"function": "decode_seq"
},
"digest": {
"length": 2870.0,
"function_hash": "7646818395750193297281703106707086099"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@80ee5054435a11c87c9a4f30f1ff750080c96416",
"signature_version": "v1"
},
{
"id": "CVE-2024-26851-2d9590b7",
"target": {
"file": "net/netfilter/nf_conntrack_h323_asn1.c",
"function": "decode_seq"
},
"digest": {
"length": 2870.0,
"function_hash": "7646818395750193297281703106707086099"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b3c0f553820516ad4b62a9390ecd28d6f73a7b13",
"signature_version": "v1"
},
{
"id": "CVE-2024-26851-2dd04673",
"target": {
"file": "net/netfilter/nf_conntrack_h323_asn1.c",
"function": "decode_seq"
},
"digest": {
"length": 2870.0,
"function_hash": "7646818395750193297281703106707086099"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@39001e3c42000e7c2038717af0d33c32319ad591",
"signature_version": "v1"
},
{
"id": "CVE-2024-26851-32239ba8",
"target": {
"file": "net/netfilter/nf_conntrack_h323_asn1.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"33987776530717456704416797918317613207",
"161109466859143793527275977949763446917",
"92831992845171171542687848668141480119",
"333448207638596296661115535385640841182",
"6582670434102846943509349798104708710",
"68158938557073841896002638755391047442",
"173209335207390474025503226489991791207",
"275897386127950793176025048048292407884"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4bafcc43baf7bcf93566394dbd15726b5b456b7a",
"signature_version": "v1"
},
{
"id": "CVE-2024-26851-4f8c0115",
"target": {
"file": "net/netfilter/nf_conntrack_h323_asn1.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"33987776530717456704416797918317613207",
"161109466859143793527275977949763446917",
"92831992845171171542687848668141480119",
"333448207638596296661115535385640841182",
"6582670434102846943509349798104708710",
"68158938557073841896002638755391047442",
"173209335207390474025503226489991791207",
"275897386127950793176025048048292407884"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@98db42191329c679f4ca52bec0b319689e1ad8cb",
"signature_version": "v1"
},
{
"id": "CVE-2024-26851-515ec763",
"target": {
"file": "net/netfilter/nf_conntrack_h323_asn1.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"33987776530717456704416797918317613207",
"161109466859143793527275977949763446917",
"92831992845171171542687848668141480119",
"333448207638596296661115535385640841182",
"6582670434102846943509349798104708710",
"68158938557073841896002638755391047442",
"173209335207390474025503226489991791207",
"275897386127950793176025048048292407884"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@80ee5054435a11c87c9a4f30f1ff750080c96416",
"signature_version": "v1"
},
{
"id": "CVE-2024-26851-71bd227b",
"target": {
"file": "net/netfilter/nf_conntrack_h323_asn1.c",
"function": "decode_seq"
},
"digest": {
"length": 2870.0,
"function_hash": "7646818395750193297281703106707086099"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ccd1108b16ab572d9bf635586b0925635dbd6bbc",
"signature_version": "v1"
},
{
"id": "CVE-2024-26851-83ecf4fb",
"target": {
"file": "net/netfilter/nf_conntrack_h323_asn1.c",
"function": "decode_seq"
},
"digest": {
"length": 2870.0,
"function_hash": "7646818395750193297281703106707086099"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@98db42191329c679f4ca52bec0b319689e1ad8cb",
"signature_version": "v1"
},
{
"id": "CVE-2024-26851-8fb344eb",
"target": {
"file": "net/netfilter/nf_conntrack_h323_asn1.c",
"function": "decode_seq"
},
"digest": {
"length": 2870.0,
"function_hash": "7646818395750193297281703106707086099"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@767146637efc528b5e3d31297df115e85a2fd362",
"signature_version": "v1"
},
{
"id": "CVE-2024-26851-9203a1bf",
"target": {
"file": "net/netfilter/nf_conntrack_h323_asn1.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"33987776530717456704416797918317613207",
"161109466859143793527275977949763446917",
"92831992845171171542687848668141480119",
"333448207638596296661115535385640841182",
"6582670434102846943509349798104708710",
"68158938557073841896002638755391047442",
"173209335207390474025503226489991791207",
"275897386127950793176025048048292407884"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@014a807f1cc9c9d5173c1cd935835553b00d211c",
"signature_version": "v1"
},
{
"id": "CVE-2024-26851-9223623d",
"target": {
"file": "net/netfilter/nf_conntrack_h323_asn1.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"33987776530717456704416797918317613207",
"161109466859143793527275977949763446917",
"92831992845171171542687848668141480119",
"333448207638596296661115535385640841182",
"6582670434102846943509349798104708710",
"68158938557073841896002638755391047442",
"173209335207390474025503226489991791207",
"275897386127950793176025048048292407884"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b3c0f553820516ad4b62a9390ecd28d6f73a7b13",
"signature_version": "v1"
},
{
"id": "CVE-2024-26851-96c06f37",
"target": {
"file": "net/netfilter/nf_conntrack_h323_asn1.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"33987776530717456704416797918317613207",
"161109466859143793527275977949763446917",
"92831992845171171542687848668141480119",
"333448207638596296661115535385640841182",
"6582670434102846943509349798104708710",
"68158938557073841896002638755391047442",
"173209335207390474025503226489991791207",
"275897386127950793176025048048292407884"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ccd1108b16ab572d9bf635586b0925635dbd6bbc",
"signature_version": "v1"
},
{
"id": "CVE-2024-26851-9abe9ffd",
"target": {
"file": "net/netfilter/nf_conntrack_h323_asn1.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"33987776530717456704416797918317613207",
"161109466859143793527275977949763446917",
"92831992845171171542687848668141480119",
"333448207638596296661115535385640841182",
"6582670434102846943509349798104708710",
"68158938557073841896002638755391047442",
"173209335207390474025503226489991791207",
"275897386127950793176025048048292407884"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@39001e3c42000e7c2038717af0d33c32319ad591",
"signature_version": "v1"
},
{
"id": "CVE-2024-26851-ac2e2344",
"target": {
"file": "net/netfilter/nf_conntrack_h323_asn1.c",
"function": "decode_seq"
},
"digest": {
"length": 2870.0,
"function_hash": "7646818395750193297281703106707086099"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@014a807f1cc9c9d5173c1cd935835553b00d211c",
"signature_version": "v1"
},
{
"id": "CVE-2024-26851-d9da35d8",
"target": {
"file": "net/netfilter/nf_conntrack_h323_asn1.c",
"function": "decode_seq"
},
"digest": {
"length": 2870.0,
"function_hash": "7646818395750193297281703106707086099"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4bafcc43baf7bcf93566394dbd15726b5b456b7a",
"signature_version": "v1"
},
{
"id": "CVE-2024-26851-e118783a",
"target": {
"file": "net/netfilter/nf_conntrack_h323_asn1.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"33987776530717456704416797918317613207",
"161109466859143793527275977949763446917",
"92831992845171171542687848668141480119",
"333448207638596296661115535385640841182",
"6582670434102846943509349798104708710",
"68158938557073841896002638755391047442",
"173209335207390474025503226489991791207",
"275897386127950793176025048048292407884"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@767146637efc528b5e3d31297df115e85a2fd362",
"signature_version": "v1"
}
]