Overview
About vulnerability
In the Linux kernel, the following vulnerability has been resolved:
l2tp: pass correct message length to ip6_append_data
l2tp_ip6_sendmsg needs to avoid accounting for the transport header twice when splicing more data into an already partially-occupied skbuff.
To manage this, we check whether the skbuff contains data using skb_queue_empty when deciding how much data to append using ip6_append_data.
However, the code which performed the calculation was incorrect:
ulen = len + skb_queue_empty(&sk->sk_write_queue) ? transhdrlen : 0;
…due to C operator precedence, this ends up setting ulen to transhdrlen for messages with a non-zero length, which results in corrupted packets on the wire.
Add parentheses to correct the calculation in line with the original intent.
Details
- Affected product:
- Debian 10 ELS , Ubuntu 16.04 ELS , Ubuntu 18.04 ELS
- Affected packages:
- linux-hwe @ 4.15.0 (+3 more)
Fixes
KernelCare state
Live-patch status from KernelCare for each operating system.
| Operating system | Status | Covered kernels |
|---|---|---|
| Amazon Linux 2 | Released |
11 kernels
|
| Amazon Linux 2 5.10 | Will Not Fix | — |
| Amazon Linux 2 5.4 | Released |
43 kernels
|
| Debian 10 | Will Not Fix | — |
| Debian 10 cloud | Will Not Fix | — |
| Debian 11 | Released |
3 kernels
|
| Debian 11 cloud | Released |
2 kernels
|
| Debian 12 | Planned | — |
| Proxmox VE 6 | Released |
41 kernels
|
| Proxmox VE 7 5.15 | Released |
44 kernels
|
| Ubuntu 18.04 AWS Focal | Released |
56 kernels
|
| Ubuntu 18.04 Azure Focal | Released |
58 kernels
|
| Ubuntu 18.04 HWE Focal | Released |
69 kernels
|
| Ubuntu 18.04 HWE GCP | Released |
15 kernels
|
| Ubuntu 20.04 | Released |
108 kernels
|
| Ubuntu 20.04 AWS | Released |
91 kernels
|
| Ubuntu 20.04 Azure | Released |
82 kernels
|
| Ubuntu 20.04 GCP | Released |
14 kernels
|
| Ubuntu 20.04 HWE AWS | Released |
39 kernels
|
| Ubuntu 20.04 HWE Azure | Released |
23 kernels
|
| Ubuntu 22.04 | Released |
52 kernels
|
| Ubuntu 22.04 AWS | Released |
46 kernels
|
| Ubuntu 22.04 Azure | Released |
43 kernels
|