In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: fully validate NFT_DATA_VALUE on store to data registers register store validation for NFT_DATA_VALUE is conditional, however, the datatype is always either NFT_DATA_VALUE or NFT_DATA_VERDICT. This only requires a new helper function to infer the register type from the set datatype so this conditional check can be removed. Otherwise, pointer to chain object can be leaked through the registers.
En el kernel de Linux, se resolvió la siguiente vulnerabilidad: netfilter: nf_tables: validar completamente NFT_DATA_VALUE en la tienda para registros de datos. La validación de la tienda para NFT_DATA_VALUE es condicional; sin embargo, el tipo de datos siempre es NFT_DATA_VALUE o NFT_DATA_VERDICT. Esto solo requiere una nueva función auxiliar para inferir el tipo de registro a partir del tipo de datos establecido para que se pueda eliminar esta verificación condicional. De lo contrario, el puntero al objeto de la cadena se puede filtrar a través de los registros.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
| Attack Vector | LOCAL |
|---|---|
| Attack Complexity | LOW |
| Privileges Required | LOW |
| User Interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality Impact | NONE |
| Integrity Impact | NONE |
| Availability Impact | HIGH |
| Source | Type | Description |
|---|---|---|
| [email protected] | Primary |
en
CWE-401
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd36a635a80> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd36a6349c0> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd385646800> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd36b99a400> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd36a636940> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd36a634e40> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd36b43d880> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd340a8cc00> | Operating System |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |