Commit 931f2d65 authored Jul 07, 2023 by Gavrilov Ilia Committed by Yongqiang Liu Jul 07, 2023

ipv6: Fix out-of-bounds access in ipv6_find_tlv()

stable inclusion
from stable-v4.19.284
commit 04bf69e3de435d793a203aacc4b774f8f9f2baeb
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I7J5UF


CVE: NA

--------------------------------

commit 878ecb08 upstream.

optlen is fetched without checking whether there is more than one byte to parse.
It can lead to out-of-bounds access.

Found by InfoTeCS on behalf of Linux Verification Center
(linuxtesting.org) with SVACE.

Fixes: c61a4043 ("[IPV6]: Find option offset by type.")
Signed-off-by: Gavrilov Ilia <Ilia.Gavrilov@infotecs.ru>
Reviewed-by: Jiri Pirko <jiri@nvidia.com>
Reviewed-by: David Ahern <dsahern@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Yongqiang Liu <liuyongqiang13@huawei.com>

parent a55e9876

net/ipv6/exthdrs_core.c

+2 −0

Original line number	Diff line number	Diff line
		@@ -142,6 +142,8 @@ int ipv6_find_tlv(const struct sk_buff *skb, int offset, int type)
		optlen = 1;
		break;
		default:
		if (len < 2)
		goto bad;
		optlen = nh[offset + 1] + 2;
		if (optlen > len)
		goto bad;