CVE - CVE-2024-26851

CVE-ID
CVE-2024-26851	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_h323: Add protection for bmp length out of range UBSAN load reports an exception of BRK#5515 SHIFT_ISSUE:Bitwise shifts that are out of bounds for their data type. vmlinux get_bitmap(b=75) + 712 <net/netfilter/nf_conntrack_h323_asn1.c:0> vmlinux decode_seq(bs=0xFFFFFFD008037000, f=0xFFFFFFD008037018, level=134443100) + 1956 <net/netfilter/nf_conntrack_h323_asn1.c:592> vmlinux decode_choice(base=0xFFFFFFD0080370F0, level=23843636) + 1216 <net/netfilter/nf_conntrack_h323_asn1.c:814> vmlinux decode_seq(f=0xFFFFFFD0080371A8, level=134443500) + 812 <net/netfilter/nf_conntrack_h323_asn1.c:576> vmlinux decode_choice(base=0xFFFFFFD008037280, level=0) + 1216 <net/netfilter/nf_conntrack_h323_asn1.c:814> vmlinux DecodeRasMessage() + 304 <net/netfilter/nf_conntrack_h323_asn1.c:833> vmlinux ras_help() + 684 <net/netfilter/nf_conntrack_h323_main.c:1728> vmlinux nf_confirm() + 188 <net/netfilter/nf_conntrack_proto.c:137> Due to abnormal data in skb->data, the extension bitmap length exceeds 32 when decoding ras message then uses the length to make a shift operation. It will change into negative after several loop. UBSAN load could detect a negative shift as an undefined behaviour and reports exception. So we add the protection to avoid the length exceeding 32. Or else it will return out of range error and stop decoding.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
MISC:https://git.kernel.org/stable/c/014a807f1cc9c9d5173c1cd935835553b00d211c URL:https://git.kernel.org/stable/c/014a807f1cc9c9d5173c1cd935835553b00d211c MISC:https://git.kernel.org/stable/c/39001e3c42000e7c2038717af0d33c32319ad591 URL:https://git.kernel.org/stable/c/39001e3c42000e7c2038717af0d33c32319ad591 MISC:https://git.kernel.org/stable/c/4bafcc43baf7bcf93566394dbd15726b5b456b7a URL:https://git.kernel.org/stable/c/4bafcc43baf7bcf93566394dbd15726b5b456b7a MISC:https://git.kernel.org/stable/c/767146637efc528b5e3d31297df115e85a2fd362 URL:https://git.kernel.org/stable/c/767146637efc528b5e3d31297df115e85a2fd362 MISC:https://git.kernel.org/stable/c/80ee5054435a11c87c9a4f30f1ff750080c96416 URL:https://git.kernel.org/stable/c/80ee5054435a11c87c9a4f30f1ff750080c96416 MISC:https://git.kernel.org/stable/c/98db42191329c679f4ca52bec0b319689e1ad8cb URL:https://git.kernel.org/stable/c/98db42191329c679f4ca52bec0b319689e1ad8cb MISC:https://git.kernel.org/stable/c/b3c0f553820516ad4b62a9390ecd28d6f73a7b13 URL:https://git.kernel.org/stable/c/b3c0f553820516ad4b62a9390ecd28d6f73a7b13 MISC:https://git.kernel.org/stable/c/ccd1108b16ab572d9bf635586b0925635dbd6bbc URL:https://git.kernel.org/stable/c/ccd1108b16ab572d9bf635586b0925635dbd6bbc
Assigning CNA
kernel.org
Date Record Created
20240219	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20240219)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)