Executive Summary

This vulnerability is an out-of-bounds (OOB) read and write issue in the Linux kernel's batman-adv module, specifically in the network-coding decode function batadv_nc_skb_decode_packet(). The function trusts a length value (coded_len) and only checks it against the destination buffer length (skb->len), but does not verify the source buffer length. This leads to reading and writing beyond the intended memory boundaries, which can cause memory corruption or crashes.

Useful 0 Not Useful 0

Impact Analysis

The out-of-bounds read and write can lead to memory corruption, which may cause system instability, crashes, or potentially allow an attacker to execute arbitrary code or escalate privileges on the affected system running the vulnerable Linux kernel module.

Useful 0 Not Useful 0

Mitigation Strategies

Update the Linux kernel to a version where the batman-adv module has the fix applied that validates coded_len against the payload area of both destination and source sk_buffs before XORing. This prevents the out-of-bounds read and write. Until then, avoid using the affected batman-adv network-coding features if possible.

Useful 0 Not Useful 0