CVE-2024-27414

Description

In the Linux kernel, the following vulnerability has been resolved:rtnetlink: fix error logic of IFLA_BRIDGE_FLAGS writing backIn the commit d73ef2d69c0d (rtnetlink: let rtnl_bridge_setlink checksIFLA_BRIDGE_MODE length), an adjustment was made to the old loop logicin the function rtnl_bridge_setlink to enable the loop to also checkthe length of the IFLA_BRIDGE_MODE attribute. However, this adjustmentremoved the break statement and led to an error logic of the flagswriting back at the end of this function.if (have_flags) memcpy(nla_data(attr), &flags, sizeof(flags)); // attr should point to IFLA_BRIDGE_FLAGS NLA !!!Before the mentioned commit, the attr is granted to be IFLA_BRIDGE_FLAGS.However, this is not necessarily true fow now as the updated loop will letthe attr point to the last NLA, even an invalid NLA which could causeoverflow writes.This patch introduces a new variable br_flag to save the NLA pointerthat points to IFLA_BRIDGE_FLAGS and uses it to resolve the mentionederror logic.

Risk Information

Associated Vulnerability

Patch Details

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234