High · published May 7, 2025
In the Linux kernel, the following vulnerability has been resolved:
net_sched: keep alloc_hash updated after hash allocation
In commit 599be01ee567 ("net_sched: fix an OOB access in cls_tcindex")
I moved cp->hash calculation before the first
tcindex_alloc_perfect_hash(), but cp->alloc_hash is left untouched.
This difference could lead to another out of bound access.
cp->alloc_hash should always be the size allocated, we should
update it after this tcindex_alloc_perfect_hash().
| Product | Versions | Fixed in |
|---|---|---|
| linux/linux_kernel | ≥ 4.4.214, < 4.4.218 | 4.4.218 |
| linux/linux_kernel | ≥ 4.9.214, < 4.9.218 | 4.9.218 |
| linux/linux_kernel | ≥ 4.14.171, < 4.14.175 | 4.14.175 |
| linux/linux_kernel | ≥ 4.19.103, < 4.19.114 | 4.19.114 |
| linux/linux_kernel | ≥ 5.4.19, < 5.4.29 | 5.4.29 |
| linux/linux_kernel | ≥ 5.5.3, < 5.5.14 | 5.5.14 |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |