CVE-2021-47245
Assigner: Linux
Published: 2024-05-21T14:19:43.648Z
State: PUBLISHED
descriptions: value: In the Linux kernel, the following vulnerability has been resolved:

netfilter: synproxy: Fix out of bounds when parsing TCP options

The TCP option parser in synproxy (synproxy_parse_options) could read
one byte out of bounds. When the length is 1, the execution flow gets
into the loop, reads one byte of the opcode, and if the opcode is
neither TCPOPT_EOL nor TCPOPT_NOP, it reads one more byte, which exceeds
the length of 1.

This fix is inspired by commit 9609dad263f8 ("ipv4: tcp_input: fix stack
out of bounds when parsing TCP options.").

v2 changes:

Added an early return when length < 0 to avoid calling
skb_header_pointer with negative length.
affected: product: Linux
vendor: Linux
defaultStatus: unaffected
repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
versions: version: 48b1de4c110a
lessThan: e1eb98cfeafd
status: affected
versionType: git
version: 48b1de4c110a
lessThan: 576c1526b4d8
status: affected
versionType: git
version: 48b1de4c110a
lessThan: 674b5f0c6a4f
status: affected
versionType: git
version: 48b1de4c110a
lessThan: 7d9a9a1a88a3
status: affected
versionType: git
version: 48b1de4c110a
lessThan: 6defc77d48ef
status: affected
versionType: git
version: 48b1de4c110a
lessThan: 9cdf299ba4e1
status: affected
versionType: git
version: 48b1de4c110a
lessThan: f648089337cb
status: affected
versionType: git
version: 48b1de4c110a
lessThan: 5fc177ab7594
status: affected
versionType: git
product: Linux
vendor: Linux
defaultStatus: affected
repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
versions: version: 3.12
status: affected
version: 0
lessThan: 3.12
status: unaffected
versionType: custom
version: 4.4.274
lessThanOrEqual: 4.4.*
status: unaffected
versionType: custom
version: 4.9.274
lessThanOrEqual: 4.9.*
status: unaffected
versionType: custom
version: 4.14.238
lessThanOrEqual: 4.14.*
status: unaffected
versionType: custom
version: 4.19.196
lessThanOrEqual: 4.19.*
status: unaffected
versionType: custom
version: 5.4.128
lessThanOrEqual: 5.4.*
status: unaffected
versionType: custom
version: 5.10.46
lessThanOrEqual: 5.10.*
status: unaffected
versionType: custom
version: 5.12.13
lessThanOrEqual: 5.12.*
status: unaffected
versionType: custom
version: 5.13
lessThanOrEqual: *
status: unaffected
versionType: original_commit_for_fix
title: netfilter: synproxy: Fix out of bounds when parsing TCP options
x_generator: engine: bippy-d175d3acf727