CVE-2022-48938
CDC-NCM: avoid overflow in sanity checking
Résumé
CDC-NCM: avoid overflow in sanity checking
Description d'origine
La description telle que publiée par la source (souvent en anglais).
In the Linux kernel, the following vulnerability has been resolved:
CDC-NCM: avoid overflow in sanity checking
A broken device may give an extreme offset like 0xFFF0
and a reasonable length for a fragment. In the sanity
check as formulated now, this will create an integer
overflow, defeating the sanity check. Both offset
and offset + len need to be checked in such a manner
that no overflow can occur.
And those quantities should be unsigned.
Paquets affectés
Linux
Kernel
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.19.323"}]},{"type":"ECOSYSTEM","events":[{"introduced":"4.20.0"},{"fixed":"5.4.285"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.5.0"},{"fixed":"5.10.103"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.7.0"},{"fixed":"5.15.26"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.11.0"},{"fixed":"5.16.12"}]}]
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Debian DEBIAN-CVE-2022-48938 linux Corrigé dans: 5.10.103-1
- Ubuntu UBUNTU-CVE-2022-48938 linux-aws Corrigé dans: 4.4.0-1138.144
Références
- advisory github.com
- advisory nvd.nist.gov
- package git.kernel.org
- web git.kernel.org
- web git.kernel.org
- web git.kernel.org
- web git.kernel.org
- web git.kernel.org
- web git.kernel.org