Description
In the Linux kernel, the following vulnerability has been resolved: rxrpc: proc: size address buffers for %pISpc output The AF_RXRPC procfs helpers format local and remote socket addresses into fixed 50-byte stack buffers with "%pISpc". That is too small for the longest current-tree IPv6-with-port form the formatter can produce. In lib/vsprintf.c, the compressed IPv6 path uses a dotted-quad tail not only for v4mapped addresses, but also for ISATAP addresses via ipv6_addr_is_isatap(). As a result, a case such as [ffff:ffff:ffff:ffff:0:5efe:255.255.255.255]:65535 is possible with the current formatter. That is 50 visible characters, so 51 bytes including the trailing NUL, which does not fit in the existing char[50] buffers used by net/rxrpc/proc.c. Size the buffers from the formatter's maximum textual form and switch the call sites to scnprintf(). Changes since v1: - correct the changelog to cite the actual maximum current-tree case explicitly - frame the proof around the ISATAP formatting path instead of the earlier mapped-v4 example
Product status
75b54cb57ca34cbe7a87c6ac757c55360a624590 (git) before 386c86412608d3449006a318a662cbcd6ca1f668
75b54cb57ca34cbe7a87c6ac757c55360a624590 (git) before 235b2115de892eab2e107a42efa7a4347baaa80b
75b54cb57ca34cbe7a87c6ac757c55360a624590 (git) before 625af53a1564e31bb2df9adc3739df46137f46c1
75b54cb57ca34cbe7a87c6ac757c55360a624590 (git) before db297c78ce537c9ac96f0eda9b25ad72c8caefa9
75b54cb57ca34cbe7a87c6ac757c55360a624590 (git) before 10ebed83f9f6414af4e85bc85ffaeda7effdd874
75b54cb57ca34cbe7a87c6ac757c55360a624590 (git) before a44ce6aa2efb61fe44f2cfab72bb01544bbca272
4.9
Any version before 4.9
5.10.258 (semver)
5.15.209 (semver)
6.1.175 (semver)
6.18.23 (semver)
6.19.13 (semver)
7.0 (original_commit_for_fix)
References
git.kernel.org/...c/386c86412608d3449006a318a662cbcd6ca1f668
git.kernel.org/...c/235b2115de892eab2e107a42efa7a4347baaa80b
git.kernel.org/...c/625af53a1564e31bb2df9adc3739df46137f46c1
git.kernel.org/...c/db297c78ce537c9ac96f0eda9b25ad72c8caefa9
git.kernel.org/...c/10ebed83f9f6414af4e85bc85ffaeda7effdd874
git.kernel.org/...c/a44ce6aa2efb61fe44f2cfab72bb01544bbca272