In the Linux kernel, the following vulnerability has been resolved:
ipv6: Fix out-of-bounds access in ipv6findtlv()
optlen is fetched without checking whether there is more than one byte to parse. It can lead to out-of-bounds access.
Found by InfoTeCS on behalf of Linux Verification Center (linuxtesting.org) with SVACE.
[
{
"id": "CVE-2023-53705-0d83acc4",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9b92e2d0eb696d7586ba832c8854653b59887da0",
"digest": {
"line_hashes": [
"93538777108713740525333776489989386233",
"76484215540132731057812711008099890017",
"297480014656009702302405330015989826178",
"63590439293102051143019121477651978708"
],
"threshold": 0.9
},
"target": {
"file": "net/ipv6/exthdrs_core.c"
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line"
},
{
"id": "CVE-2023-53705-1355188e",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@04bf69e3de435d793a203aacc4b774f8f9f2baeb",
"digest": {
"length": 647.0,
"function_hash": "116386936282003169688319951040066868006"
},
"target": {
"file": "net/ipv6/exthdrs_core.c",
"function": "ipv6_find_tlv"
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function"
},
{
"id": "CVE-2023-53705-1649b20e",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@59e656d0d4a84ea0ee9a39c6f69160a3effccc94",
"digest": {
"length": 647.0,
"function_hash": "116386936282003169688319951040066868006"
},
"target": {
"file": "net/ipv6/exthdrs_core.c",
"function": "ipv6_find_tlv"
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function"
},
{
"id": "CVE-2023-53705-2dfc31c3",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ae68c0f7edbc9a294094ce03a0aaf45aa489ce40",
"digest": {
"line_hashes": [
"93538777108713740525333776489989386233",
"76484215540132731057812711008099890017",
"297480014656009702302405330015989826178",
"63590439293102051143019121477651978708"
],
"threshold": 0.9
},
"target": {
"file": "net/ipv6/exthdrs_core.c"
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line"
},
{
"id": "CVE-2023-53705-5bbd0266",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@878ecb0897f4737a4c9401f3523fd49589025671",
"digest": {
"line_hashes": [
"93538777108713740525333776489989386233",
"76484215540132731057812711008099890017",
"297480014656009702302405330015989826178",
"63590439293102051143019121477651978708"
],
"threshold": 0.9
},
"target": {
"file": "net/ipv6/exthdrs_core.c"
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line"
},
{
"id": "CVE-2023-53705-5f1cf8a4",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@04bf69e3de435d793a203aacc4b774f8f9f2baeb",
"digest": {
"line_hashes": [
"93538777108713740525333776489989386233",
"76484215540132731057812711008099890017",
"297480014656009702302405330015989826178",
"63590439293102051143019121477651978708"
],
"threshold": 0.9
},
"target": {
"file": "net/ipv6/exthdrs_core.c"
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line"
},
{
"id": "CVE-2023-53705-622dd074",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@011f47c8b8389154f996f5f69da8efc3a3beefef",
"digest": {
"length": 647.0,
"function_hash": "116386936282003169688319951040066868006"
},
"target": {
"file": "net/ipv6/exthdrs_core.c",
"function": "ipv6_find_tlv"
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function"
},
{
"id": "CVE-2023-53705-a87f7d1b",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@878ecb0897f4737a4c9401f3523fd49589025671",
"digest": {
"length": 647.0,
"function_hash": "116386936282003169688319951040066868006"
},
"target": {
"file": "net/ipv6/exthdrs_core.c",
"function": "ipv6_find_tlv"
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function"
},
{
"id": "CVE-2023-53705-a9313136",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@91dd8aab9c9f193210681b86b6b92840ffe74f0c",
"digest": {
"length": 647.0,
"function_hash": "116386936282003169688319951040066868006"
},
"target": {
"file": "net/ipv6/exthdrs_core.c",
"function": "ipv6_find_tlv"
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function"
},
{
"id": "CVE-2023-53705-b0ecf0ac",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e5f82688ae10f5f386952e65e941bb8868ee54dc",
"digest": {
"length": 647.0,
"function_hash": "116386936282003169688319951040066868006"
},
"target": {
"file": "net/ipv6/exthdrs_core.c",
"function": "ipv6_find_tlv"
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function"
},
{
"id": "CVE-2023-53705-b4d1709c",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9b92e2d0eb696d7586ba832c8854653b59887da0",
"digest": {
"length": 647.0,
"function_hash": "116386936282003169688319951040066868006"
},
"target": {
"file": "net/ipv6/exthdrs_core.c",
"function": "ipv6_find_tlv"
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function"
},
{
"id": "CVE-2023-53705-d8f13a05",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@011f47c8b8389154f996f5f69da8efc3a3beefef",
"digest": {
"line_hashes": [
"93538777108713740525333776489989386233",
"76484215540132731057812711008099890017",
"297480014656009702302405330015989826178",
"63590439293102051143019121477651978708"
],
"threshold": 0.9
},
"target": {
"file": "net/ipv6/exthdrs_core.c"
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line"
},
{
"id": "CVE-2023-53705-e60df426",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@91dd8aab9c9f193210681b86b6b92840ffe74f0c",
"digest": {
"line_hashes": [
"93538777108713740525333776489989386233",
"76484215540132731057812711008099890017",
"297480014656009702302405330015989826178",
"63590439293102051143019121477651978708"
],
"threshold": 0.9
},
"target": {
"file": "net/ipv6/exthdrs_core.c"
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line"
},
{
"id": "CVE-2023-53705-e91c5c62",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@59e656d0d4a84ea0ee9a39c6f69160a3effccc94",
"digest": {
"line_hashes": [
"93538777108713740525333776489989386233",
"76484215540132731057812711008099890017",
"297480014656009702302405330015989826178",
"63590439293102051143019121477651978708"
],
"threshold": 0.9
},
"target": {
"file": "net/ipv6/exthdrs_core.c"
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line"
},
{
"id": "CVE-2023-53705-eaf337f2",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ae68c0f7edbc9a294094ce03a0aaf45aa489ce40",
"digest": {
"length": 647.0,
"function_hash": "116386936282003169688319951040066868006"
},
"target": {
"file": "net/ipv6/exthdrs_core.c",
"function": "ipv6_find_tlv"
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function"
},
{
"id": "CVE-2023-53705-f04617c2",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e5f82688ae10f5f386952e65e941bb8868ee54dc",
"digest": {
"line_hashes": [
"93538777108713740525333776489989386233",
"76484215540132731057812711008099890017",
"297480014656009702302405330015989826178",
"63590439293102051143019121477651978708"
],
"threshold": 0.9
},
"target": {
"file": "net/ipv6/exthdrs_core.c"
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line"
}
]