In the Linux kernel, the following vulnerability has been resolved:
rtnetlink: fix error logic of IFLABRIDGEFLAGS writing back
In the commit d73ef2d69c0d ("rtnetlink: let rtnlbridgesetlink checks
IFLABRIDGEMODE length"), an adjustment was made to the old loop logic
in the function rtnl_bridge_setlink to enable the loop to also check
the length of the IFLABRIDGEMODE attribute. However, this adjustment
removed the break statement and led to an error logic of the flags
writing back at the end of this function.
if (haveflags) memcpy(nladata(attr), &flags, sizeof(flags)); // attr should point to IFLABRIDGEFLAGS NLA !!!
Before the mentioned commit, the attr is granted to be IFLABRIDGEFLAGS.
However, this is not necessarily true fow now as the updated loop will let
the attr point to the last NLA, even an invalid NLA which could cause
overflow writes.
This patch introduces a new variable br_flag to save the NLA pointer
that points to IFLABRIDGEFLAGS and uses it to resolve the mentioned
error logic.
[
{
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"43368890233235107232882422294223180341",
"255585248481078803729890777568607241467",
"108347219685320934958342080440114053982",
"180901857567472135446577514341300271008",
"296680890166051555287359161735679048442",
"195537838816677608790568692434926323026",
"229163422589808974320768013407502743923",
"166760320344703114591973492061709480696",
"103141576154871199797046130493514702",
"181316109373711743080489302123511049803",
"256530944281300665324671062689318120746",
"53784755251613138749322663124795404849",
"83824645597210401556373731826731901596",
"210911025373835535318250363379302156936",
"33030590521116094414114330032208799249",
"46249561148178069422096070588372261400",
"143739945522551599459700970047327376901",
"170158026402206448688520045023171194168",
"248532950314028863462473799851089532191"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a1227b27fcccc99dc44f912b479e01a17e2d7d31",
"target": {
"file": "net/core/rtnetlink.c"
},
"id": "CVE-2024-27414-0d1d79cf"
},
{
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"43368890233235107232882422294223180341",
"255585248481078803729890777568607241467",
"108347219685320934958342080440114053982",
"180901857567472135446577514341300271008",
"296680890166051555287359161735679048442",
"195537838816677608790568692434926323026",
"229163422589808974320768013407502743923",
"166760320344703114591973492061709480696",
"103141576154871199797046130493514702",
"181316109373711743080489302123511049803",
"256530944281300665324671062689318120746",
"53784755251613138749322663124795404849",
"83824645597210401556373731826731901596",
"210911025373835535318250363379302156936",
"33030590521116094414114330032208799249",
"46249561148178069422096070588372261400",
"143739945522551599459700970047327376901",
"170158026402206448688520045023171194168",
"248532950314028863462473799851089532191"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@743ad091fb46e622f1b690385bb15e3cd3daf874",
"target": {
"file": "net/core/rtnetlink.c"
},
"id": "CVE-2024-27414-0f577d31"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 1554.0,
"function_hash": "103449439482979795908058545305109428179"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b9fbc44159dfc3e9a7073032752d9e03f5194a6f",
"target": {
"file": "net/core/rtnetlink.c",
"function": "rtnl_bridge_setlink"
},
"id": "CVE-2024-27414-11e9039d"
},
{
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"43368890233235107232882422294223180341",
"255585248481078803729890777568607241467",
"108347219685320934958342080440114053982",
"180901857567472135446577514341300271008",
"296680890166051555287359161735679048442",
"195537838816677608790568692434926323026",
"229163422589808974320768013407502743923",
"166760320344703114591973492061709480696",
"103141576154871199797046130493514702",
"181316109373711743080489302123511049803",
"256530944281300665324671062689318120746",
"53784755251613138749322663124795404849",
"83824645597210401556373731826731901596",
"210911025373835535318250363379302156936",
"33030590521116094414114330032208799249",
"46249561148178069422096070588372261400",
"143739945522551599459700970047327376901",
"170158026402206448688520045023171194168",
"248532950314028863462473799851089532191"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b9fbc44159dfc3e9a7073032752d9e03f5194a6f",
"target": {
"file": "net/core/rtnetlink.c"
},
"id": "CVE-2024-27414-231d2db5"
},
{
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"43368890233235107232882422294223180341",
"255585248481078803729890777568607241467",
"108347219685320934958342080440114053982",
"180901857567472135446577514341300271008",
"296680890166051555287359161735679048442",
"195537838816677608790568692434926323026",
"229163422589808974320768013407502743923",
"166760320344703114591973492061709480696",
"103141576154871199797046130493514702",
"181316109373711743080489302123511049803",
"256530944281300665324671062689318120746",
"53784755251613138749322663124795404849",
"83824645597210401556373731826731901596",
"210911025373835535318250363379302156936",
"33030590521116094414114330032208799249",
"46249561148178069422096070588372261400",
"143739945522551599459700970047327376901",
"170158026402206448688520045023171194168",
"248532950314028863462473799851089532191"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f2261eb994aa5757c1da046b78e3229a3ece0ad9",
"target": {
"file": "net/core/rtnetlink.c"
},
"id": "CVE-2024-27414-55e1351b"
},
{
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"43368890233235107232882422294223180341",
"255585248481078803729890777568607241467",
"108347219685320934958342080440114053982",
"180901857567472135446577514341300271008",
"296680890166051555287359161735679048442",
"195537838816677608790568692434926323026",
"229163422589808974320768013407502743923",
"166760320344703114591973492061709480696",
"103141576154871199797046130493514702",
"181316109373711743080489302123511049803",
"256530944281300665324671062689318120746",
"53784755251613138749322663124795404849",
"83824645597210401556373731826731901596",
"210911025373835535318250363379302156936",
"33030590521116094414114330032208799249",
"46249561148178069422096070588372261400",
"143739945522551599459700970047327376901",
"170158026402206448688520045023171194168",
"248532950314028863462473799851089532191"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@882a51a10ecf24ce135d573afa0872aef02c5125",
"target": {
"file": "net/core/rtnetlink.c"
},
"id": "CVE-2024-27414-56784541"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 1554.0,
"function_hash": "103449439482979795908058545305109428179"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@831bc2728fb48a8957a824cba8c264b30dca1425",
"target": {
"file": "net/core/rtnetlink.c",
"function": "rtnl_bridge_setlink"
},
"id": "CVE-2024-27414-7213e072"
},
{
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"43368890233235107232882422294223180341",
"255585248481078803729890777568607241467",
"108347219685320934958342080440114053982",
"180901857567472135446577514341300271008",
"296680890166051555287359161735679048442",
"195537838816677608790568692434926323026",
"229163422589808974320768013407502743923",
"166760320344703114591973492061709480696",
"103141576154871199797046130493514702",
"181316109373711743080489302123511049803",
"256530944281300665324671062689318120746",
"53784755251613138749322663124795404849",
"83824645597210401556373731826731901596",
"210911025373835535318250363379302156936",
"33030590521116094414114330032208799249",
"46249561148178069422096070588372261400",
"143739945522551599459700970047327376901",
"170158026402206448688520045023171194168",
"248532950314028863462473799851089532191"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@831bc2728fb48a8957a824cba8c264b30dca1425",
"target": {
"file": "net/core/rtnetlink.c"
},
"id": "CVE-2024-27414-73ed33b1"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 1554.0,
"function_hash": "103449439482979795908058545305109428179"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a1227b27fcccc99dc44f912b479e01a17e2d7d31",
"target": {
"file": "net/core/rtnetlink.c",
"function": "rtnl_bridge_setlink"
},
"id": "CVE-2024-27414-8a606b8f"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 1554.0,
"function_hash": "103449439482979795908058545305109428179"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@882a51a10ecf24ce135d573afa0872aef02c5125",
"target": {
"file": "net/core/rtnetlink.c",
"function": "rtnl_bridge_setlink"
},
"id": "CVE-2024-27414-8a941168"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 1554.0,
"function_hash": "103449439482979795908058545305109428179"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@743ad091fb46e622f1b690385bb15e3cd3daf874",
"target": {
"file": "net/core/rtnetlink.c",
"function": "rtnl_bridge_setlink"
},
"id": "CVE-2024-27414-adf52191"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 1554.0,
"function_hash": "103449439482979795908058545305109428179"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f2261eb994aa5757c1da046b78e3229a3ece0ad9",
"target": {
"file": "net/core/rtnetlink.c",
"function": "rtnl_bridge_setlink"
},
"id": "CVE-2024-27414-fc944cd5"
}
]