Overview
About vulnerability
In the Linux kernel, the following vulnerability has been resolved:
net/ipv6: ioam6: prevent schema length wraparound in trace fill
ioam6_fill_trace_data() stores the schema contribution to the trace length in a u8. With bit 22 enabled and the largest schema payload, sclen becomes 1 + 1020 / 4, wraps from 256 to 0, and bypasses the remaining-space check. __ioam6_fill_trace_data() then positions the write cursor without reserving the schema area but still copies the 4-byte schema header and the full schema payload, overrunning the trace buffer.
Keep sclen in an unsigned int so the remaining-space check and the write cursor calculation both see the full schema length.
Details
- Affected product:
- Ubuntu 20.04 ELS
- Affected packages:
- linux-meta @ 5.4.0 (+1 more)
Fixes
KernelCare state
Live-patch status from KernelCare for each operating system.
| Operating system | Status | Covered kernels |
|---|---|---|
| AlmaLinux 10 | Released |
44 kernels
|
| Amazon Linux 2023 | Planned | — |
| Debian 13 | Planned | — |
| Proxmox VE 7 5.15 | Released |
47 kernels
|
| RHEL 10 | Released |
47 kernels
|
| Rocky Linux 10 | Released |
32 kernels
|
| Ubuntu 20.04 HWE AWS | Released |
57 kernels
|
| Ubuntu 20.04 HWE Azure | Released |
40 kernels
|
| Ubuntu 22.04 | Released |
96 kernels
|
| Ubuntu 22.04 AWS | Released |
87 kernels
|
| Ubuntu 22.04 Azure | Released |
77 kernels
|
| Ubuntu 24.04 | Planned | — |
| Ubuntu 24.04 AWS | Planned | — |