In the Linux kernel, the following vulnerability has been resolved: bridge: br_nd_send: validate ND option lengths br_nd_send() walks ND options according to option-provided lengths. A malformed option can make the parser advance beyond the computed option span or use a too-short source LLADDR option payload. Validate option lengths against the remaining NS option area before advancing, and only read source LLADDR when the option is large enough for an Ethernet address.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
| Attack Vector | LOCAL |
|---|---|
| Attack Complexity | LOW |
| Privileges Required | LOW |
| User Interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality Impact | NONE |
| Integrity Impact | NONE |
| Availability Impact | HIGH |
| Source | Type | Description |
|---|---|---|
| [email protected] | Primary |
en
NVD-CWE-noinfo
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| linux | linux_kernel | * | <built-in method update of dict object at 0x702bdc60c7c0> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x702bdcca90c0> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x702bdc60d4c0> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x702bdccaaf80> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x702bdc60f9c0> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x702bdc60d100> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x702c45379040> | Operating System |
| linux | linux_kernel | 7.0 | <built-in method update of dict object at 0x702bdc60c380> | Operating System |
| linux | linux_kernel | 7.0 | <built-in method update of dict object at 0x702bdd3488c0> | Operating System |
| linux | linux_kernel | 7.0 | <built-in method update of dict object at 0x702bdc60e0c0> | Operating System |
| linux | linux_kernel | 7.0 | <built-in method update of dict object at 0x702b829c1d80> | Operating System |
| linux | linux_kernel | 7.0 | <built-in method update of dict object at 0x702bdc60cec0> | Operating System |
| linux | linux_kernel | 7.0 | <built-in method update of dict object at 0x702bdc60d580> | Operating System |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:* |