Executive Summary

This vulnerability exists in the Linux kernel's netfilter ebtables component, specifically in the function compat_mtw_from_user(). This function converts ebtables extensions from 32-bit user structures to kernel native structures but does not properly validate the user-supplied match_size and target_size.

If a user provides a size smaller than what the extension requires, the kernel's translation logic may perform out-of-bounds memory reads, which can lead to memory safety issues. The vulnerability was detected by KASAN (Kernel Address Sanitizer).

The fix ensures that match_size is at least as large as the extension's required size, preventing these out-of-bounds reads while maintaining compatibility with standard targets.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to out-of-bounds memory reads in the kernel when processing certain ebtables extensions. Such memory safety issues may cause system instability, crashes, or potentially expose sensitive kernel memory contents.

While the description does not explicitly mention privilege escalation or remote code execution, out-of-bounds reads can be a stepping stone for attackers to gather information or cause denial of service.

Useful 0 Not Useful 0