In the Linux kernel, the following vulnerability has been resolved: 6lowpan: fix off-by-one in multicast context address compression The second memcpy in lowpan_iphc_mcast_ctx_addr_compress() uses &data[1] as destination and &ipaddr->s6_addr[11] as source, but both should be offset by one: &data[2] and &ipaddr->s6_addr[12] respectively. This off-by-one has two consequences: 1. data[1] is overwritten with s6_addr[11], corrupting the RIID field in the compressed multicast address 2. data[5] is never written, so uninitialized kernel stack memory is transmitted over the network via lowpan_push_hc_data(), leaking kernel stack contents The correct inline data layout must match what the decompression function lowpan_uncompress_multicast_ctx_daddr() expects: data[0..1] = s6_addr[1..2] (flags/scope + RIID) data[2..5] = s6_addr[12..15] (group ID) Also zero-initialize the data array as a defensive measure against similar bugs in the future.
| Vendor | Product | Versions |
|---|---|---|
| linux | linux kernel | 5609c185f24dffca5f6a9c127106869da150be03, 5609c185f24dffca5f6a9c127106869da150be03, 5609c185f24dffca5f6a9c127106869da150be03, 5609c185f24dffca5f6a9c127106869da150be03, 5609c185f24dffca5f6a9c127106869da150be03, 5609c185f24dffca5f6a9c127106869da150be03, 5609c185f24dffca5f6a9c127106869da150be03, 5609c185f24dffca5f6a9c127106869da150be03, 4.6, 7.0.12, 5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.94, 6.18.36, 7.0.13, 7.1 |
Updated description with technical details, marked exploit as available, and listed affected versions including new fixes.
Updated description with critical severity, added affected version 7.0.12, and noted no exploit exists.
Initial creation
