In the Linux kernel, the following vulnerability has been resolved:
bridge: br_nd_send: linearize skb before parsing ND options
br_nd_send() parses neighbour discovery options from ns->opt[] and
assumes that these options are in the linear part of request. Its callers only guarantee that the ICMPv6 header and target address
are available, so the option area can still be non-linear. Parsing
ns->opt[] in that case can access data past the linear buffer.
Linearize request before option parsing and derive ns from the linear network header.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Privileges Required
None
No privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
None
No data modification
Availability
High
Complete denial of service
CVSS Vector v3.1
Weakness Type (CWE)
Vulnerable Products 14
| Configuration | From (including) | Up to (excluding) |
|---|---|---|
|
Linux Linux_Kernel
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
|
4.15
|
5.10.253
|
|
Linux Linux_Kernel
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
|
4.15
|
5.15.203
|
|
Linux Linux_Kernel
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
|
4.15
|
6.1.168
|
|
Linux Linux_Kernel
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
|
4.15
|
6.6.134
|
|
Linux Linux_Kernel
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
|
4.15
|
6.12.81
|
|
Linux Linux_Kernel
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
|
4.15
|
6.18.22
|
|
Linux Linux_Kernel
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
|
4.15
|
6.19.12
|
|
Linux Linux_Kernel
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
|
4.15
|
7.0
|
|
Linux Linux_Kernel
cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*
|
— | — |
|
Linux Linux_Kernel
cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*
|
— | — |
|
Linux Linux_Kernel
cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*
|
— | — |
|
Linux Linux_Kernel
cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*
|
— | — |
|
Linux Linux_Kernel
cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*
|
— | — |
|
Linux Linux_Kernel
cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*
|
— | — |
References 11
https://git.kernel.org/stable/c/c68433fd291c9e88c00292095172c62d1997d662
NVD
https://git.kernel.org/stable/c/4f397b950c916e9a1f8a4fce04ea0110206cad47
NVD
https://git.kernel.org/stable/c/bd91ec85aa4c77d645bd2739fc56784157a88ca2
NVD
https://git.kernel.org/stable/c/658261898130da620fc3d0fbb0523efb3366cb55
NVD
https://git.kernel.org/stable/c/2ba4caba423ed94d63006eb1d2227b0332ab7fcd
NVD
https://git.kernel.org/stable/c/9c55e41c73af5c4511070933b1bd25248521270c
NVD
https://git.kernel.org/stable/c/3a30f6469b058574f49efde61cd6f5d79e576053
NVD
https://git.kernel.org/stable/c/a01aee7cafc575bb82f5529e8734e7052f9b16ea
NVD
https://cert-portal.siemens.com/productcert/html/ssa-019113.html
0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
https://cert-portal.siemens.com/productcert/html/ssa-082556.html
0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
https://cert-portal.siemens.com/productcert/html/ssa-457936.html
0b142b55-0307-4c5a-b3c9-f314f3fb7c5e