Description
In the Linux kernel, the following vulnerability has been resolved: 6lowpan: fix off-by-one in multicast context address compression The second memcpy in lowpan_iphc_mcast_ctx_addr_compress() uses &data[1] as destination and &ipaddr->s6_addr[11] as source, but both should be offset by one: &data[2] and &ipaddr->s6_addr[12] respectively. This off-by-one has two consequences: 1. data[1] is overwritten with s6_addr[11], corrupting the RIID field in the compressed multicast address 2. data[5] is never written, so uninitialized kernel stack memory is transmitted over the network via lowpan_push_hc_data(), leaking kernel stack contents The correct inline data layout must match what the decompression function lowpan_uncompress_multicast_ctx_daddr() expects: data[0..1] = s6_addr[1..2] (flags/scope + RIID) data[2..5] = s6_addr[12..15] (group ID) Also zero-initialize the data array as a defensive measure against similar bugs in the future.
Product status
5609c185f24dffca5f6a9c127106869da150be03 (git) before f24a58c72a45f4c109f3557a760cc4b60b7a6037
5609c185f24dffca5f6a9c127106869da150be03 (git) before da8cbb64b47e9066b40af0de170901caf17b768c
5609c185f24dffca5f6a9c127106869da150be03 (git) before 4485d79617520d84ba5a14515e2b5136007d6deb
5609c185f24dffca5f6a9c127106869da150be03 (git) before 06ce6fc106b16dec9b535950db626261be865e5b
5609c185f24dffca5f6a9c127106869da150be03 (git) before dcb1bec1c32ee5c3878354e087cf5dbee2b7c7af
5609c185f24dffca5f6a9c127106869da150be03 (git) before c32f30ef5e66adbfa102348e2e8a23776eb007cb
5609c185f24dffca5f6a9c127106869da150be03 (git) before da8808463882c3f3c357b072e25053c2121f1419
5609c185f24dffca5f6a9c127106869da150be03 (git) before 2a58899d11009bffc7b4b32a571858f381121837
4.6
Any version before 4.6
5.10.259 (semver)
5.15.210 (semver)
6.1.176 (semver)
6.6.143 (semver)
6.12.94 (semver)
6.18.36 (semver)
7.0.13 (semver)
7.1 (original_commit_for_fix)
References
git.kernel.org/...c/f24a58c72a45f4c109f3557a760cc4b60b7a6037
git.kernel.org/...c/da8cbb64b47e9066b40af0de170901caf17b768c
git.kernel.org/...c/4485d79617520d84ba5a14515e2b5136007d6deb
git.kernel.org/...c/06ce6fc106b16dec9b535950db626261be865e5b
git.kernel.org/...c/dcb1bec1c32ee5c3878354e087cf5dbee2b7c7af
git.kernel.org/...c/c32f30ef5e66adbfa102348e2e8a23776eb007cb
git.kernel.org/...c/da8808463882c3f3c357b072e25053c2121f1419
git.kernel.org/...c/2a58899d11009bffc7b4b32a571858f381121837