REJECTED/Cmnt: [SRU][N][PATCH 0/1] CVE-2024-42284

[Stefan Bader]

On 18.09.24 07:06, Koichiro Den wrote:
> [Impact]
> 
> tipc: Return non-zero value from tipc_udp_addr2str() on error
> 
> tipc_udp_addr2str() should return non-zero value if the UDP media
> address is invalid. Otherwise, a buffer overflow access can occur in
> tipc_media_addr_printf(). Fix this by returning 1 on an invalid UDP
> media address.
> 
> [Fix]
> 
> Noble:  Clean cherry-pick
> Jammy:  fixed via stable
> Focal:  fixed via stable
> Bionic: fix sent to esm ML
> Xenial: fix sent to esm ML
> Trusty: not affected
> 
> [Test case]
> 
> Compile and boot tested
> 
> [Where problem could occur]
> 
> This fix affects those who use TIPC protocol, an issue with this fix
> would be visible to the user via unpredicted system behavior due to
> potential OOB read, or in a less severe case broken messages shown on
> kernel ring buffer and/or trace buffer.
> 
> 
> Shigeru Yoshida (1):
>    tipc: Return non-zero value from tipc_udp_addr2str() on error
> 
>   net/tipc/udp_media.c | 5 ++++-
>   1 file changed, 4 insertions(+), 1 deletion(-)
> 

Already applied: upstream stable patchset 2024-09-30. I added the CVE 
number to the commit message already present.

-Stefan
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_0xE8675DEECBEECEA3.asc
Type: application/pgp-keys
Size: 48643 bytes
Desc: OpenPGP public key
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20241025/54711f1d/attachment-0001.key>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20241025/54711f1d/attachment-0001.sig>