Description
In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_meta_bridge: fix stale stack leak via IIFHWADDR register NFT_META_BRI_IIFHWADDR declares its destination register with len = ETH_ALEN (6 bytes), which the register-init tracking rounds up to two 32-bit registers (8 bytes). nft_meta_bridge_get_eval() then does memcpy(dest, br_dev->dev_addr, ETH_ALEN), writing only 6 bytes and leaving the upper 2 bytes of the second register as uninitialised nft_do_chain() stack. A downstream load of that register span leaks those stale bytes to userspace. Zero the second register before the memcpy so the full declared span is written.
Product status
cbd2257dc96e3e46217540fcb095a757ffa20d96 (git) before 07acb9798477535933bd658ac9fa85b6cb10d995
cbd2257dc96e3e46217540fcb095a757ffa20d96 (git) before f1e81d571e375d10e50e852223593493d98c1bac
cbd2257dc96e3e46217540fcb095a757ffa20d96 (git) before c7d573551f9286100a055ef696cde6af54549677
6.18
Any version before 6.18
6.18.36 (semver)
7.0.13 (semver)
7.1 (original_commit_for_fix)
References
git.kernel.org/...c/07acb9798477535933bd658ac9fa85b6cb10d995
git.kernel.org/...c/f1e81d571e375d10e50e852223593493d98c1bac
git.kernel.org/...c/c7d573551f9286100a055ef696cde6af54549677