312 lines
16 KiB
JSON
312 lines
16 KiB
JSON
{
|
||
"dataType": "CVE_RECORD",
|
||
"dataVersion": "5.2",
|
||
"cveMetadata": {
|
||
"cveId": "CVE-2026-43452",
|
||
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
||
"state": "PUBLISHED",
|
||
"assignerShortName": "Linux",
|
||
"dateReserved": "2026-05-01T14:12:56.010Z",
|
||
"datePublished": "2026-05-08T14:22:17.361Z",
|
||
"dateUpdated": "2026-10-19T19:26:36.945Z"
|
||
},
|
||
"containers": {
|
||
"cna": {
|
||
"providerMetadata": {
|
||
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
||
"shortName": "Linux",
|
||
"dateUpdated": "2026-08-05T12:28:01.123Z"
|
||
},
|
||
"descriptions": [
|
||
{
|
||
"lang": "en",
|
||
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: x_tables: guard option walkers against 1-byte tail reads\n\nWhen the last byte of options is a non-single-byte option kind, walkers\nthat advance with i += op[i + 1] ? : 1 can read op[i + 1] past the end\nof the option area.\n\nAdd an explicit i == optlen - 1 check before dereferencing op[i + 1]\nin xt_tcpudp and xt_dccp option walkers."
|
||
}
|
||
],
|
||
"metrics": [
|
||
{
|
||
"cvssV3_1": {
|
||
"version": "3.1",
|
||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
|
||
"baseScore": 8.2,
|
||
"baseSeverity": "HIGH"
|
||
},
|
||
"scenarios": [
|
||
{
|
||
"lang": "en",
|
||
"value": "AV:N - In a reasonable highest-impact deployment, an internet-facing host or firewall has an x_tables TCP/DCCP option match rule installed, and the vulnerable walker is then reached by unauthenticated network packets. A remote attacker can craft TCP or DCCP options ending with a non-single-byte option kind to trigger the tail read.\nAC:L - The trigger is deterministic packet content: make the last option byte a kind value >= 2 without a following length byte. There is no race, timing requirement, or attacker-uncontrolled memory layout condition needed to reach the bug.\nPR:N - The network packet path requires no local account or authentication once the affected rule is present. Although local rule installation is gated by CAP_NET_ADMIN in the network namespace and is user-namespace reachable, the highest reasonable trigger path is unauthenticated remote traffic.\nUI:N - No victim user action is required for each exploit attempt. The attacker only sends crafted packets to a system whose netfilter rules inspect TCP or DCCP options.\nS:U - The vulnerable code executes in the target kernel’s own netfilter packet-processing context. It does not cross a separate security authority such as a VM or device/IOMMU boundary.\nC:L - The primitive is a strictly bounded one-byte out-of-bounds read past the option area, not an arbitrary read primitive. Because it can access adjacent kernel memory, limited confidentiality impact is the higher defensible value.\nI:N - The bug performs only an out-of-bounds read of op[i + 1]; it does not write memory or corrupt kernel structures. The read byte only affects loop advancement at the tail and does not provide an integrity-changing primitive.\nA:H - Malformed packets can repeatedly trigger a kernel out-of-bounds read in the netfilter hot path. On hardened, sanitizing, or faulting deployments this can produce an oops or panic, so availability impact is high."
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"affected": [
|
||
{
|
||
"product": "Linux",
|
||
"vendor": "Linux",
|
||
"defaultStatus": "unaffected",
|
||
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
||
"programFiles": [
|
||
"net/netfilter/xt_dccp.c",
|
||
"net/netfilter/xt_tcpudp.c"
|
||
],
|
||
"versions": [
|
||
{
|
||
"version": "2e4e6a17af35be359cc8f1c924f8f198fbd478cc",
|
||
"lessThan": "c2a445367a496a3c25dbc940c10c8bd1cfd4c14a",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "2e4e6a17af35be359cc8f1c924f8f198fbd478cc",
|
||
"lessThan": "ae1e1267650638136b84c23f2b31250f0ccb6823",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "2e4e6a17af35be359cc8f1c924f8f198fbd478cc",
|
||
"lessThan": "c39f84e4be1be63fc60ca7141ea7b76edcea5907",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "2e4e6a17af35be359cc8f1c924f8f198fbd478cc",
|
||
"lessThan": "9b94f0e42ed248eb31929da84ed9f5310d7ff540",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "2e4e6a17af35be359cc8f1c924f8f198fbd478cc",
|
||
"lessThan": "5b18b8b35c7cded2d17b2b2604c9b0694ff48d1c",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "2e4e6a17af35be359cc8f1c924f8f198fbd478cc",
|
||
"lessThan": "bc18551c6169eac5ed813778d3e3e484002dbbe5",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "2e4e6a17af35be359cc8f1c924f8f198fbd478cc",
|
||
"lessThan": "d04800323336eebf441d153f43234eac9b833d36",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "2e4e6a17af35be359cc8f1c924f8f198fbd478cc",
|
||
"lessThan": "cfe770220ac2dbd3e104c6b45094037455da81d4",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"product": "Linux",
|
||
"vendor": "Linux",
|
||
"defaultStatus": "affected",
|
||
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
||
"programFiles": [
|
||
"net/netfilter/xt_dccp.c",
|
||
"net/netfilter/xt_tcpudp.c"
|
||
],
|
||
"versions": [
|
||
{
|
||
"version": "2.6.16",
|
||
"status": "affected"
|
||
},
|
||
{
|
||
"version": "0",
|
||
"lessThan": "2.6.16",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "5.10.253",
|
||
"lessThanOrEqual": "5.10.*",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "5.15.203",
|
||
"lessThanOrEqual": "5.15.*",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "6.1.167",
|
||
"lessThanOrEqual": "6.1.*",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "6.6.130",
|
||
"lessThanOrEqual": "6.6.*",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "6.12.78",
|
||
"lessThanOrEqual": "6.12.*",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "6.18.19",
|
||
"lessThanOrEqual": "6.18.*",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "6.19.9",
|
||
"lessThanOrEqual": "6.19.*",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "7.0",
|
||
"lessThanOrEqual": "*",
|
||
"status": "unaffected",
|
||
"versionType": "original_commit_for_fix"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"cpeApplicability": [
|
||
{
|
||
"nodes": [
|
||
{
|
||
"operator": "OR",
|
||
"negate": false,
|
||
"cpeMatch": [
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "2.6.16",
|
||
"versionEndExcluding": "5.10.253"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "2.6.16",
|
||
"versionEndExcluding": "5.15.203"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "2.6.16",
|
||
"versionEndExcluding": "6.1.167"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "2.6.16",
|
||
"versionEndExcluding": "6.6.130"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "2.6.16",
|
||
"versionEndExcluding": "6.12.78"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "2.6.16",
|
||
"versionEndExcluding": "6.18.19"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "2.6.16",
|
||
"versionEndExcluding": "6.19.9"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "2.6.16",
|
||
"versionEndExcluding": "7.0"
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"references": [
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/c2a445367a496a3c25dbc940c10c8bd1cfd4c14a"
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/ae1e1267650638136b84c23f2b31250f0ccb6823"
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/c39f84e4be1be63fc60ca7141ea7b76edcea5907"
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/9b94f0e42ed248eb31929da84ed9f5310d7ff540"
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/5b18b8b35c7cded2d17b2b2604c9b0694ff48d1c"
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/bc18551c6169eac5ed813778d3e3e484002dbbe5"
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/d04800323336eebf441d153f43234eac9b833d36"
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/cfe770220ac2dbd3e104c6b45094037455da81d4"
|
||
}
|
||
],
|
||
"title": "netfilter: x_tables: guard option walkers against 1-byte tail reads",
|
||
"x_generator": {
|
||
"engine": "bippy-1.2.0"
|
||
}
|
||
},
|
||
"adp": [
|
||
{
|
||
"metrics": [
|
||
{
|
||
"other": {
|
||
"type": "ssvc",
|
||
"content": {
|
||
"id": "CVE-2026-43452",
|
||
"role": "CISA Coordinator",
|
||
"options": [
|
||
{
|
||
"Exploitation": "none"
|
||
},
|
||
{
|
||
"Automatable": "yes"
|
||
},
|
||
{
|
||
"Technical Impact": "partial"
|
||
}
|
||
],
|
||
"version": "2.0.3",
|
||
"timestamp": "2026-10-16T15:17:27.922262Z"
|
||
}
|
||
}
|
||
}
|
||
],
|
||
"problemTypes": [
|
||
{
|
||
"descriptions": [
|
||
{
|
||
"lang": "en",
|
||
"type": "CWE",
|
||
"cweId": "CWE-125",
|
||
"description": "CWE-125 Out-of-bounds Read"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"title": "CISA ADP Vulnrichment",
|
||
"providerMetadata": {
|
||
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||
"shortName": "CISA-ADP",
|
||
"dateUpdated": "2026-10-19T19:26:36.945Z"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
} |