Description
In the Linux kernel, the following vulnerability has been resolved: mpls: add seqcount to protect the platform_label{,s} pair The RCU-protected codepaths (mpls_forward, mpls_dump_routes) can have an inconsistent view of platform_labels vs platform_label in case of a concurrent resize (resize_platform_label_table, under platform_mutex). This can lead to OOB accesses. This patch adds a seqcount, so that we get a consistent snapshot. Note that mpls_label_ok is also susceptible to this, so the check against RTA_DST in rtm_to_route_config, done outside platform_mutex, is not sufficient. This value gets passed to mpls_label_ok once more in both mpls_route_add and mpls_route_del, so there is no issue, but that additional check must not be removed.
Product status
7720c01f3f590116882e251f13c7e1d5602f8643 (git) before 5bb3caf0bbfb56f1a00d2af072ac3d8395a3b9ef
7720c01f3f590116882e251f13c7e1d5602f8643 (git) before 629ec78ef8608d955ce217880cdc3e1873af3a15
4.1
Any version before 4.1
6.19.12 (semver)
7.0 (original_commit_for_fix)
References
git.kernel.org/...c/5bb3caf0bbfb56f1a00d2af072ac3d8395a3b9ef
git.kernel.org/...c/629ec78ef8608d955ce217880cdc3e1873af3a15