Executive Summary

This vulnerability exists in the Linux kernel's media subsystem, specifically in the dvb-net component. It involves an out-of-bounds (OOB) access in the ULE extension header tables used in the function handle_one_ule_extension().

Two tables, ule_mandatory_ext_handlers[] and ule_optional_ext_handlers[], are declared with 255 elements indexed from 0 to 254. However, the index htype is derived from network-controlled data and can have a value from 0 to 255. When htype equals 255, it causes an out-of-bounds read on these tables, potentially leading to the OOB value being called as a function pointer.

The fix involves adding a bounds check on htype before accessing the tables. If htype is out of range, the SNDU (Subnetwork Data Unit) is discarded to prevent the OOB access.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to an out-of-bounds read and potentially the execution of unintended function pointers. This may cause system instability, crashes, or potentially allow an attacker to execute arbitrary code within the kernel context.

Since the vulnerability is triggered by network-controlled data, a remote attacker could exploit this by sending specially crafted network packets to the affected system.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, update the Linux kernel to a version where the issue has been fixed. The fix involves adding a bounds check on the htype index before accessing the extension header tables, preventing out-of-bounds access.

Until the update is applied, avoid processing untrusted or malformed ULE packets that could trigger the out-of-bounds access.

Useful 0 Not Useful 0