APPLIED[L/J]: [SRU][F/J/L][PATCH 0/1] CVE-2023-42754

[Stefan Bader]

On 19.10.23 00:49, Yuxuan Luo wrote:
> [Impact]
> A NULL pointer dereference flaw was found in the Linux kernel ipv4 stack.
> The socket buffer (skb) was assumed to be associated with a device before
> calling __ip_options_compile, which is not always the case if the skb is
> re-routed by ipvs. This issue may allow a local user with CAP_NET_ADMIN
> privileges to crash the system.
> 
> [Backport]
> It's a clean backport.
> 
> [Test]
> Tested against [the poc](https://vuldb.com/?exploit_url.241116) with
> privilege since the exploit requires it.
> 
> [Potential Regression]
> Expect very low regression potential.
> 
> 
> Kyle Zeng (1):
>    ipv4: fix null-deref in ipv4_link_failure
> 
>   net/ipv4/route.c | 4 +++-
>   1 file changed, 3 insertions(+), 1 deletion(-)
> 

Applied to lunar,jammy:linux/master-next. Thanks.

-Stefan
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_0xE8675DEECBEECEA3.asc
Type: application/pgp-keys
Size: 44613 bytes
Desc: OpenPGP public key
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20231020/7b1f78b8/attachment-0001.key>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20231020/7b1f78b8/attachment-0001.sig>