In the Linux kernel, the following vulnerability has been resolved:
net/smc: check ipareaoffset and ipv6prefixes_cnt when receiving proposal msg
When receiving proposal msg in server, the field ipareaoffset and the field ipv6prefixescnt in proposal msg are from the remote client and can not be fully trusted. Especially the field ipareaoffset, once exceed the max value, there has the chance to access wrong address, and crash may happen.
This patch checks ipareaoffset and ipv6prefixes_cnt before using them.
[
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"213278234263678131731520466084788674999",
"212144612532684468707643886541454883581",
"250509689672755682391401059717690128651",
"223193196858395986189929681556220314883"
]
},
"id": "CVE-2024-49571-04f290e9",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@47ce46349672a7e0c361bfe39ed0b22e824ef4fb",
"target": {
"file": "net/smc/smc_clc.c"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"213278234263678131731520466084788674999",
"212144612532684468707643886541454883581",
"250509689672755682391401059717690128651",
"223193196858395986189929681556220314883"
]
},
"id": "CVE-2024-49571-08273854",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@62056d1592e63d85e82357ee2ae6a6a294f440b0",
"target": {
"file": "net/smc/smc_clc.c"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"195095840234076755294375487723698911442",
"52658450387440055623825003509313599826",
"11789982443074468350249739285709020208",
"183808659027572396325074135981672519639",
"329583024400417297022690121113226890559",
"113413407627545805643367992538677557564",
"169601260404814647627774552645180789613",
"132831499932512422540042206539539763468"
]
},
"id": "CVE-2024-49571-0acdeef6",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@47ce46349672a7e0c361bfe39ed0b22e824ef4fb",
"target": {
"file": "net/smc/af_smc.c"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"195095840234076755294375487723698911442",
"52658450387440055623825003509313599826",
"11789982443074468350249739285709020208",
"183808659027572396325074135981672519639",
"329583024400417297022690121113226890559",
"113413407627545805643367992538677557564",
"169601260404814647627774552645180789613",
"182552332729712962619202503300535445354"
]
},
"id": "CVE-2024-49571-2c41a695",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@62056d1592e63d85e82357ee2ae6a6a294f440b0",
"target": {
"file": "net/smc/af_smc.c"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 645.0,
"function_hash": "34033159536919682452031262414493747728"
},
"id": "CVE-2024-49571-3763df9f",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a29e220d3c8edbf0e1beb0f028878a4a85966556",
"target": {
"file": "net/smc/af_smc.c",
"function": "smc_find_ism_v1_device_serv"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"213278234263678131731520466084788674999",
"212144612532684468707643886541454883581",
"250509689672755682391401059717690128651",
"223193196858395986189929681556220314883"
]
},
"id": "CVE-2024-49571-46940a94",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a29e220d3c8edbf0e1beb0f028878a4a85966556",
"target": {
"file": "net/smc/smc_clc.c"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 154.0,
"function_hash": "6539189370181038174175462886607594192"
},
"id": "CVE-2024-49571-6134e7e3",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@47ce46349672a7e0c361bfe39ed0b22e824ef4fb",
"target": {
"file": "net/smc/smc_clc.h",
"function": "smc_clc_proposal_get_prefix"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"286008578733118898419070284901163920443",
"83303734408376784918827031883186183022",
"183086183686314090151986631447287346824",
"194840014840777533950030362406878993477",
"294275268561074859990022489252501915694",
"98131704428055355839413531551431649548"
]
},
"id": "CVE-2024-49571-761a7bf0",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a29e220d3c8edbf0e1beb0f028878a4a85966556",
"target": {
"file": "net/smc/smc_clc.h"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 884.0,
"function_hash": "76777070388438101031580282515250714171"
},
"id": "CVE-2024-49571-82675909",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@62056d1592e63d85e82357ee2ae6a6a294f440b0",
"target": {
"file": "net/smc/smc_clc.c",
"function": "smc_clc_msg_prop_valid"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 884.0,
"function_hash": "76777070388438101031580282515250714171"
},
"id": "CVE-2024-49571-8a2f2716",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a29e220d3c8edbf0e1beb0f028878a4a85966556",
"target": {
"file": "net/smc/smc_clc.c",
"function": "smc_clc_msg_prop_valid"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 154.0,
"function_hash": "6539189370181038174175462886607594192"
},
"id": "CVE-2024-49571-942742a7",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a29e220d3c8edbf0e1beb0f028878a4a85966556",
"target": {
"file": "net/smc/smc_clc.h",
"function": "smc_clc_proposal_get_prefix"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 261.0,
"function_hash": "45558662815636268335803091653049749943"
},
"id": "CVE-2024-49571-9b888713",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@47ce46349672a7e0c361bfe39ed0b22e824ef4fb",
"target": {
"file": "net/smc/af_smc.c",
"function": "smc_listen_prfx_check"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 261.0,
"function_hash": "45558662815636268335803091653049749943"
},
"id": "CVE-2024-49571-a2e0b0c2",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a29e220d3c8edbf0e1beb0f028878a4a85966556",
"target": {
"file": "net/smc/af_smc.c",
"function": "smc_listen_prfx_check"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 595.0,
"function_hash": "334100761125095269745278697763118745763"
},
"id": "CVE-2024-49571-a311ca7d",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@62056d1592e63d85e82357ee2ae6a6a294f440b0",
"target": {
"file": "net/smc/af_smc.c",
"function": "smc_find_ism_v1_device_serv"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"286008578733118898419070284901163920443",
"83303734408376784918827031883186183022",
"183086183686314090151986631447287346824",
"194840014840777533950030362406878993477",
"294275268561074859990022489252501915694",
"98131704428055355839413531551431649548"
]
},
"id": "CVE-2024-49571-a9aea561",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@62056d1592e63d85e82357ee2ae6a6a294f440b0",
"target": {
"file": "net/smc/smc_clc.h"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 884.0,
"function_hash": "76777070388438101031580282515250714171"
},
"id": "CVE-2024-49571-ab7baf77",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@47ce46349672a7e0c361bfe39ed0b22e824ef4fb",
"target": {
"file": "net/smc/smc_clc.c",
"function": "smc_clc_msg_prop_valid"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"286008578733118898419070284901163920443",
"83303734408376784918827031883186183022",
"183086183686314090151986631447287346824",
"194840014840777533950030362406878993477",
"294275268561074859990022489252501915694",
"98131704428055355839413531551431649548"
]
},
"id": "CVE-2024-49571-b57b4ac6",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@47ce46349672a7e0c361bfe39ed0b22e824ef4fb",
"target": {
"file": "net/smc/smc_clc.h"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 154.0,
"function_hash": "6539189370181038174175462886607594192"
},
"id": "CVE-2024-49571-ce50a119",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@62056d1592e63d85e82357ee2ae6a6a294f440b0",
"target": {
"file": "net/smc/smc_clc.h",
"function": "smc_clc_proposal_get_prefix"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"195095840234076755294375487723698911442",
"52658450387440055623825003509313599826",
"11789982443074468350249739285709020208",
"183808659027572396325074135981672519639",
"329583024400417297022690121113226890559",
"113413407627545805643367992538677557564",
"169601260404814647627774552645180789613",
"132831499932512422540042206539539763468"
]
},
"id": "CVE-2024-49571-de527057",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a29e220d3c8edbf0e1beb0f028878a4a85966556",
"target": {
"file": "net/smc/af_smc.c"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 261.0,
"function_hash": "45558662815636268335803091653049749943"
},
"id": "CVE-2024-49571-fb00d377",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@62056d1592e63d85e82357ee2ae6a6a294f440b0",
"target": {
"file": "net/smc/af_smc.c",
"function": "smc_listen_prfx_check"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 645.0,
"function_hash": "34033159536919682452031262414493747728"
},
"id": "CVE-2024-49571-ff4e97fe",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@47ce46349672a7e0c361bfe39ed0b22e824ef4fb",
"target": {
"file": "net/smc/af_smc.c",
"function": "smc_find_ism_v1_device_serv"
}
}
]