Buffer Overflow in Linux Kernel batman-adv TVLV Handling

Executive Summary

This vulnerability exists in the Linux kernel's batman-adv component, specifically in the handling of TVLV packets. The function batadv_tvlv_container_list_size() calculates the total size of a TVLV packet section using a 16-bit unsigned integer (u16) accumulator. If the total size exceeds the maximum value for u16 (U16_MAX), the size value wraps around, resulting in an undersized allocation in batadv_tvlv_container_ogm_append(). Consequently, a memcpy-style operation writes beyond the allocated buffer, causing kernel memory corruption.

The fix involved changing the return type of batadv_tvlv_container_list_size() to size_t to prevent overflow, and adding a check in batadv_tvlv_container_ogm_append() to ensure the computed length does not exceed U16_MAX, aborting the operation if it does.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to kernel memory corruption due to a buffer overflow caused by an undersized memory allocation followed by an out-of-bounds write. Such corruption can destabilize the system, potentially causing crashes, data loss, or enabling an attacker to execute arbitrary code with kernel privileges.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, update your Linux kernel to a version where the batman-adv module includes the fix that rejects oversized TVLV packets. This fix involves widening the return type in batadv_tvlv_container_list_size() and adding checks against U16_MAX to prevent buffer overflows.

If updating the kernel immediately is not possible, consider disabling or restricting the use of the batman-adv module to prevent processing of potentially malicious TVLV packets.

Useful 0 Not Useful 0