title: l2tp: pass correct message length to ip6_append_data
description: In the Linux kernel, the following vulnerability has been resolved:
l2tp: pass correct message length to ip6_append_data
l2tp_ip6_sendmsg needs to avoid accounting for the transport header
twice when splicing more data into an already partially-occupied skbuff.
To manage this, we check whether the skbuff contains data using
skb_queue_empty when deciding how much data to append using
ip6_append_data.
However, the code which performed the calculation was incorrect:
ulen = len + skb_queue_empty(&sk->sk_write_queue) ? transhdrlen : 0;
...due to C operator precedence, this ends up setting ulen to
transhdrlen for messages with a non-zero length, which results in
corrupted packets on the wire.
Add parentheses to correct the calculation in line with the original
intent.
affected:
{
product: Linux
vendor: Linux
defaultStatus: unaffected
repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
versions:
version: 559d697c5d07, lessThan: 4c3ce64bc9d3, status: affected, versionType: git
version: 1fc793d68d50, lessThan: c1d3a84a67db, status: affected, versionType: git
version: 96b2e1090397, lessThan: dcb4d1426859, status: affected, versionType: git
version: cd1189956393, lessThan: 0da15a703951, status: affected, versionType: git
version: f6a7182179c0, lessThan: 13cd1daeea84, status: affected, versionType: git
version: 9d4c75800f61, lessThan: 804bd8650a3a, status: affected, versionType: git
version: 9d4c75800f61, lessThan: 83340c66b498, status: affected, versionType: git
version: 9d4c75800f61, lessThan: 359e54a93ab4, status: affected, versionType: git
}
{
product: Linux
vendor: Linux
defaultStatus: affected
repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
versions:
version: 6.6, status: affected
version: 0, lessThan: 6.6, status: unaffected, versionType: custom
version: 4.19.308, lessThanOrEqual: 4.19.*, status: unaffected, versionType: custom
version: 5.4.270, lessThanOrEqual: 5.4.*, status: unaffected, versionType: custom
version: 5.10.211, lessThanOrEqual: 5.10.*, status: unaffected, versionType: custom
version: 5.15.150, lessThanOrEqual: 5.15.*, status: unaffected, versionType: custom
version: 6.1.80, lessThanOrEqual: 6.1.*, status: unaffected, versionType: custom
version: 6.6.19, lessThanOrEqual: 6.6.*, status: unaffected, versionType: custom
version: 6.7.7, lessThanOrEqual: 6.7.*, status: unaffected, versionType: custom
version: 6.8, lessThanOrEqual: *, status: unaffected, versionType: original_commit_for_fix
}
