title: netfilter: nftables: exthdr: fix 4-byte stack OOB write
description: In the Linux kernel, the following vulnerability has been resolved:
netfilter: nftables: exthdr: fix 4-byte stack OOB write
If priv->len is a multiple of 4, then dst[len / 4] can write past
the destination array which leads to stack corruption.
This construct is necessary to clean the remainder of the register
in case ->len is NOT a multiple of the register size, so make it
conditional just like nft_payload.c does.
The bug was added in 4.1 cycle and then copied/inherited when
tcp/sctp and ip option support was added.
Bug reported by Zero Day Initiative project (ZDI-CAN-21950,
ZDI-CAN-21951, ZDI-CAN-21961).
affected:
{
product: Linux
vendor: Linux
defaultStatus: unaffected
repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
versions:
version: 49499c3e6e18, lessThan: a7d86a77c33b, status: affected, versionType: git
version: 49499c3e6e18, lessThan: 1ad7b189cc14, status: affected, versionType: git
version: 49499c3e6e18, lessThan: d9ebfc0f2137, status: affected, versionType: git
version: 49499c3e6e18, lessThan: c8f292322ff1, status: affected, versionType: git
version: 49499c3e6e18, lessThan: fd94d9dadee5, status: affected, versionType: git
}
{
product: Linux
vendor: Linux
defaultStatus: affected
repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
versions:
version: 4.1, status: affected
version: 0, lessThan: 4.1, status: unaffected, versionType: custom
version: 5.10.198, lessThanOrEqual: 5.10.*, status: unaffected, versionType: custom
version: 5.15.132, lessThanOrEqual: 5.15.*, status: unaffected, versionType: custom
version: 6.1.54, lessThanOrEqual: 6.1.*, status: unaffected, versionType: custom
version: 6.5.4, lessThanOrEqual: 6.5.*, status: unaffected, versionType: custom
version: 6.6, lessThanOrEqual: *, status: unaffected, versionType: original_commit_for_fix
}
