Buffer Overread in Linux Kernel x_tables

Executive Summary

This vulnerability exists in the Linux kernel's netfilter subsystem, specifically in the x_tables module that handles option walkers.

The issue occurs when the last byte of options is a non-single-byte option kind. The code that processes these options advances by using the value of the next byte (op[i + 1]) to determine how far to move forward. However, if this next byte is read past the end of the option area, it results in a 1-byte tail read beyond the valid memory.

The fix involves adding an explicit check to ensure that the index i is not at the last byte (i == optlen - 1) before dereferencing op[i + 1], preventing out-of-bounds reads in the xt_tcpudp and xt_dccp option walkers.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to out-of-bounds memory reads (1-byte tail reads) in the Linux kernel's netfilter subsystem.

Such out-of-bounds reads may cause system instability, crashes, or potentially expose sensitive kernel memory data, which could be leveraged by attackers for further exploitation.

Useful 0 Not Useful 0