Към съдържанието
Търсене

CVE-2026-31415: Linux

Няма оценка

CVSS

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

    Описание

    Оригинално описание

    In the Linux kernel, the following vulnerability has been resolved: ipv6: avoid overflows in ip6_datagram_send_ctl() Yiming Qian reported : <quote> I believe I found a locally triggerable kernel bug in the IPv6 sendmsg ancillary-data path that can panic the kernel via `skb_under_panic()` (local DoS). The core issue is a mismatch between: - a 16-bit length accumulator (`struct ipv6_txoptions::opt_flen`, type `__u16`) and - a pointer to the *last* provided destination-options header (`opt->dst1opt`) when multiple `IPV6_DSTOPTS` control messages (cmsgs) are provided. - `include/net/ipv6.h`: - `struct ipv6_txoptions::opt_flen` is `__u16` (wrap possible). (lines 291-307, especially 298) - `net/ipv6/datagram.c:ip6_datagram_send_ctl()`: - Accepts repeated `IPV6_DSTOPTS` and accumulates into `opt_flen` without rejecting duplicates. (lines 909-933) - `net/ipv6/ip6_output.c:__ip6_append_data()`: - Uses `opt->opt_flen + opt->opt_nflen` to compute header sizes/headroom decisions. (lines 1448-1466, especially 1463-1465) - `net/ipv6/ip6_output.c:__ip6_make_skb()`: - Calls `ipv6_push_frag_opts()` if `opt->opt_flen` is non-zero. (lines 1930-1934) - `net/ipv6/exthdrs.c:ipv6_push_frag_opts()` / `ipv6_push_exthdr()`: - Push size comes from `ipv6_optlen(opt->dst1opt)` (based on the pointed-to header). (lines 1179-1185 and 1206-1211) 1. `opt_flen` is a 16-bit accumulator: - `include/net/ipv6.h:298` defines `__u16 opt_flen; /* after fragment hdr */`. 2. `ip6_datagram_send_ctl()` accepts *repeated* `IPV6_DSTOPTS` cmsgs and increments `opt_flen` each time: - In `net/ipv6/datagram.c:909-933`, for `IPV6_DSTOPTS`: - It computes `len = ((hdr->hdrlen + 1) << 3);` - It checks `CAP_NET_RAW` using `ns_capable(net->user_ns, CAP_NET_RAW)`. (line 922) - Then it does: - `opt->opt_flen += len;` (line 927) - `opt->dst1opt = hdr;` (line 928) There is no duplicate rejection here (unlike the legacy `IPV6_2292DSTOPTS` path which rejects

    Засегнати продукти

    • Linux Linux: 333fad5364d6b457c8d837f7d05802d2aaf8a961 преди 2dbfb003bbf3fc0e94f07efefab0ebcf83029a2a; 333fad5364d6b457c8d837f7d05802d2aaf8a961 преди 4082f9984a694829153115d28c956a3534f52f29; 333fad5364d6b457c8d837f7d05802d2aaf8a961 преди 0bdaf54d3aaddfe8df29371260fa8d4939b4fd6f; 333fad5364d6b457c8d837f7d05802d2aaf8a961 преди 5e4ee5dbea134e9257f205e31a96040bed71e83f; 333fad5364d6b457c8d837f7d05802d2aaf8a961 преди 63fda74885555e6bd1623b5d811feec998740ba4; 333fad5364d6b457c8d837f7d05802d2aaf8a961 преди 9ed81d692758dfb9471d7799b24bfa7a08224c31; 333fad5364d6b457c8d837f7d05802d2aaf8a961 преди 872b74900d5daa37067ac676d9001bb929fc6a2a; 333fad5364d6b457c8d837f7d05802d2aaf8a961 преди 4e453375561fc60820e6b9d8ebeb6b3ee177d42e
    • Linux Linux: 2.6.14; преди 2.6.14; 5.10.253 до 5.10.*; 5.15.203 до 5.15.*; 6.1.168 до 6.1.*; 6.6.134 до 6.6.*; 6.12.81 до 6.12.*; 6.18.22 до 6.18.*; 6.19.12 до 6.19.*; от 7.0 нататък
    • Siemens: още 3 продукта, добавени от Siemens

      SIMATIC S7-1500 CPU 1518-4 PN/DP MFP, SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP, SIPLUS S7-1500 CPU 1518-4 PN/DP MFP

    История

    • 13 април 2026 Публикувано

    Други уязвимости в Linux Linux

    Първоизточници

    CVE-2026-31415: Linux | freedomonline.bg