Critical · published February 26, 2024
In the Linux kernel, the following vulnerability has been resolved:
netlabel: fix out-of-bounds memory accesses
There are two array out-of-bounds memory accesses, one in
cipso_v4_map_lvl_valid(), the other in netlbl_bitmap_walk(). Both
errors are embarassingly simple, and the fixes are straightforward.
As a FYI for anyone backporting this patch to kernels prior to v4.8,
you'll want to apply the netlbl_bitmap_walk() patch to
cipso_v4_bitmap_walk() as netlbl_bitmap_walk() doesn't exist before
Linux v4.8.
| Product | Versions | Fixed in |
|---|---|---|
| linux/linux_kernel | ≥ 2.6.19, < 3.16.66 | 3.16.66 |
| linux/linux_kernel | ≥ 3.17.0, < 3.18.137 | 3.18.137 |
| linux/linux_kernel | ≥ 3.19.0, < 4.4.177 | 4.4.177 |
| linux/linux_kernel | ≥ 4.5.0, < 4.9.163 | 4.9.163 |
| linux/linux_kernel | ≥ 4.10.0, < 4.14.106 | 4.14.106 |
| linux/linux_kernel | ≥ 4.15.0, < 4.19.28 | 4.19.28 |
| linux/linux_kernel | ≥ 4.20.0, < 4.20.15 | 4.20.15 |