In the Linux kernel, the following vulnerability has been resolved: 6lowpan: fix off-by-one in multicast context address compression The second memcpy in lowpan_iphc_mcast_ctx_addr_compress() uses &data[1] as destination and &ipaddr->s6_addr[11] as source, but both should be offset by one: &data[2] and &ipaddr->s6_addr[12] respectively. This off-by-one has two consequences: 1. data[1] is overwritten with s6_addr[11], corrupting the RIID field in the compressed multicast address 2. data[5] is never written, so uninitialized kernel stack memory is transmitted over the network via lowpan_push_hc_data(), leaking kernel stack contents The correct inline data layout must match what the decompression function lowpan_uncompress_multicast_ctx_daddr() expects: data[0..1] = s6_addr[1..2] (flags/scope + RIID) data[2..5] = s6_addr[12..15] (group ID) Also zero-initialize the data array as a defensive measure against similar bugs in the future.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
| Attack Vector | LOCAL |
|---|---|
| Attack Complexity | LOW |
| Privileges Required | LOW |
| User Interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality Impact | NONE |
| Integrity Impact | NONE |
| Availability Impact | HIGH |
| Source | Type | Description |
|---|---|---|
| [email protected] | Primary |
en
CWE-193
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd360691440> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd384e28440> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd3081a7400> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd384e28ac0> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd360692180> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd360691a40> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd360693040> | Operating System |
| linux | linux_kernel | 7.1 | <built-in method update of dict object at 0x7fd3606922c0> | Operating System |
| linux | linux_kernel | 7.1 | <built-in method update of dict object at 0x7fd369a4cbc0> | Operating System |
| linux | linux_kernel | 7.1 | <built-in method update of dict object at 0x7fd3606937c0> | Operating System |
| linux | linux_kernel | 7.1 | <built-in method update of dict object at 0x7fd3703cd7c0> | Operating System |
| linux | linux_kernel | 7.1 | <built-in method update of dict object at 0x7fd384e28900> | Operating System |
| linux | linux_kernel | 7.1 | <built-in method update of dict object at 0x7fd36865a940> | Operating System |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.1:rc5:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.1:rc6:*:*:*:*:*:* |