2024-02-25 14:00:47 +00:00
{
2024-05-17 12:00:35 +00:00
"data_version" : "4.0" ,
2024-02-25 14:00:47 +00:00
"data_type" : "CVE" ,
"data_format" : "MITRE" ,
"CVE_data_meta" : {
"ID" : "CVE-2024-27414" ,
2024-05-17 12:00:35 +00:00
"ASSIGNER" : "cve@kernel.org" ,
"STATE" : "PUBLIC"
2024-02-25 14:00:47 +00:00
} ,
"description" : {
"description_data" : [
{
"lang" : "eng" ,
2024-05-17 12:00:35 +00:00
"value" : "In the Linux kernel, the following vulnerability has been resolved:\n\nrtnetlink: fix error logic of IFLA_BRIDGE_FLAGS writing back\n\nIn the commit d73ef2d69c0d (\"rtnetlink: let rtnl_bridge_setlink checks\nIFLA_BRIDGE_MODE length\"), an adjustment was made to the old loop logic\nin the function `rtnl_bridge_setlink` to enable the loop to also check\nthe length of the IFLA_BRIDGE_MODE attribute. However, this adjustment\nremoved the `break` statement and led to an error logic of the flags\nwriting back at the end of this function.\n\nif (have_flags)\n memcpy(nla_data(attr), &flags, sizeof(flags));\n // attr should point to IFLA_BRIDGE_FLAGS NLA !!!\n\nBefore the mentioned commit, the `attr` is granted to be IFLA_BRIDGE_FLAGS.\nHowever, this is not necessarily true fow now as the updated loop will let\nthe attr point to the last NLA, even an invalid NLA which could cause\noverflow writes.\n\nThis patch introduces a new variable `br_flag` to save the NLA pointer\nthat points to IFLA_BRIDGE_FLAGS and uses it to resolve the mentioned\nerror logic."
}
]
} ,
"problemtype" : {
"problemtype_data" : [
{
"description" : [
{
"lang" : "eng" ,
"value" : "n/a"
}
]
}
]
} ,
"affects" : {
"vendor" : {
"vendor_data" : [
{
"vendor_name" : "Linux" ,
"product" : {
"product_data" : [
{
"product_name" : "Linux" ,
"version" : {
"version_data" : [
{
"version_affected" : "<" ,
"version_name" : "ad46d4861ed3" ,
"version_value" : "b9fbc44159df"
} ,
{
"version_affected" : "<" ,
"version_name" : "abb0172fa8dc" ,
"version_value" : "882a51a10ecf"
} ,
{
"version_affected" : "<" ,
"version_name" : "047508edd602" ,
"version_value" : "a1227b27fccc"
} ,
{
"version_affected" : "<" ,
"version_name" : "8dfac8071d58" ,
"version_value" : "f2261eb994aa"
} ,
{
"version_affected" : "<" ,
"version_name" : "d73ef2d69c0d" ,
"version_value" : "167d8642daa6"
} ,
{
"version_value" : "not down converted" ,
"x_cve_json_5_version_data" : {
"versions" : [
{
"version" : "6.5" ,
"status" : "affected"
} ,
{
"version" : "0" ,
"lessThan" : "6.5" ,
"status" : "unaffected" ,
"versionType" : "custom"
} ,
{
"version" : "5.4.271" ,
"lessThanOrEqual" : "5.4.*" ,
"status" : "unaffected" ,
"versionType" : "custom"
} ,
{
"version" : "5.10.212" ,
"lessThanOrEqual" : "5.10.*" ,
"status" : "unaffected" ,
"versionType" : "custom"
} ,
{
"version" : "5.15.151" ,
"lessThanOrEqual" : "5.15.*" ,
"status" : "unaffected" ,
"versionType" : "custom"
} ,
{
"version" : "6.1.81" ,
"lessThanOrEqual" : "6.1.*" ,
"status" : "unaffected" ,
"versionType" : "custom"
} ,
{
"version" : "6.6.21" ,
"lessThanOrEqual" : "6.6.*" ,
"status" : "unaffected" ,
"versionType" : "custom"
} ,
{
"version" : "6.7.9" ,
"lessThanOrEqual" : "6.7.*" ,
"status" : "unaffected" ,
"versionType" : "custom"
} ,
{
"version" : "6.8" ,
"lessThanOrEqual" : "*" ,
"status" : "unaffected" ,
"versionType" : "original_commit_for_fix"
}
] ,
"defaultStatus" : "affected"
}
}
]
}
}
]
}
}
]
}
} ,
"references" : {
"reference_data" : [
{
"url" : "https://git.kernel.org/stable/c/b9fbc44159dfc3e9a7073032752d9e03f5194a6f" ,
"refsource" : "MISC" ,
"name" : "https://git.kernel.org/stable/c/b9fbc44159dfc3e9a7073032752d9e03f5194a6f"
} ,
{
"url" : "https://git.kernel.org/stable/c/882a51a10ecf24ce135d573afa0872aef02c5125" ,
"refsource" : "MISC" ,
"name" : "https://git.kernel.org/stable/c/882a51a10ecf24ce135d573afa0872aef02c5125"
} ,
{
"url" : "https://git.kernel.org/stable/c/a1227b27fcccc99dc44f912b479e01a17e2d7d31" ,
"refsource" : "MISC" ,
"name" : "https://git.kernel.org/stable/c/a1227b27fcccc99dc44f912b479e01a17e2d7d31"
} ,
{
"url" : "https://git.kernel.org/stable/c/f2261eb994aa5757c1da046b78e3229a3ece0ad9" ,
"refsource" : "MISC" ,
"name" : "https://git.kernel.org/stable/c/f2261eb994aa5757c1da046b78e3229a3ece0ad9"
} ,
{
"url" : "https://git.kernel.org/stable/c/167d8642daa6a44b51de17f8ff0f584e1e762db7" ,
"refsource" : "MISC" ,
"name" : "https://git.kernel.org/stable/c/167d8642daa6a44b51de17f8ff0f584e1e762db7"
} ,
{
"url" : "https://git.kernel.org/stable/c/831bc2728fb48a8957a824cba8c264b30dca1425" ,
"refsource" : "MISC" ,
"name" : "https://git.kernel.org/stable/c/831bc2728fb48a8957a824cba8c264b30dca1425"
} ,
{
"url" : "https://git.kernel.org/stable/c/743ad091fb46e622f1b690385bb15e3cd3daf874" ,
"refsource" : "MISC" ,
"name" : "https://git.kernel.org/stable/c/743ad091fb46e622f1b690385bb15e3cd3daf874"
2024-06-25 23:00:34 +00:00
} ,
{
"url" : "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html" ,
"refsource" : "MISC" ,
"name" : "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html"
2024-02-25 14:00:47 +00:00
}
]
2024-05-17 12:00:35 +00:00
} ,
"generator" : {
2024-05-29 06:02:31 +00:00
"engine" : "bippy-a5840b7849dd"
2024-02-25 14:00:47 +00:00
}
}
