Messages in this thread Patch in this message | | | From | Gavrilov Ilia <> | Subject | [PATCH net] ipv6: Fix out-of-bounds access in ipv6_find_tlv() | Date | Tue, 23 May 2023 08:29:44 +0000 |
| |
optlen is fetched without checking whether there is more than one byte to parse. It can lead to out-of-bounds access.
Found by InfoTeCS on behalf of Linux Verification Center (linuxtesting.org) with SVACE.
Fixes: 3c73a0368e99 ("ipv6: Update ipv6 static library with newly needed functions") Signed-off-by: Gavrilov Ilia <Ilia.Gavrilov@infotecs.ru> --- net/ipv6/exthdrs_core.c | 2 ++ 1 file changed, 2 insertions(+)
diff --git a/net/ipv6/exthdrs_core.c b/net/ipv6/exthdrs_core.c index da46c4284676..49e31e4ae7b7 100644 --- a/net/ipv6/exthdrs_core.c +++ b/net/ipv6/exthdrs_core.c @@ -143,6 +143,8 @@ int ipv6_find_tlv(const struct sk_buff *skb, int offset, int type) optlen = 1; break; default: + if (len < 2) + goto bad; optlen = nh[offset + 1] + 2; if (optlen > len) goto bad; -- 2.30.2
| |