https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 00:04:18 +0000 https://cve.radiocsirt.org/vuln/cve-2024-50142 <p><strong>Affected:</strong> Linux, Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>xfrm: validate new SA&#39;s prefixlen using SA family when sel.family is unset</p> <p>This expands the validation introduced in commit 07bf7908950a (&#34;xfrm: Validate address prefix lengths in the xfrm selector.&#34;)</p> <p>syzbot created an SA with usersa.sel.family = AF_UNSPEC usersa.sel.prefixlen_s = 128 usersa.family = AF_INET</p> <p>Because of the AF_UNSPEC selector, verify_newsa_info doesn&#39;t put limits on prefixlen_{s,d}. But then copy_from_user_state sets x-&gt;sel.family to usersa.family (AF_INET). Do the same conversion in verify_newsa_info before validating prefixlen_{s,d}, since that&#39;s how prefixlen is going to be used later on.</p> <p><strong>Affected:</strong> Linux, Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>xfrm: validate new SA&#39;s prefixlen using SA family when sel.family is unset</p> <p>This expands the validation introduced in commit 07bf7908950a (&#34;xfrm: Validate address prefix lengths in the xfrm selector.&#34;)</p> <p>syzbot created an SA with usersa.sel.family = AF_UNSPEC usersa.sel.prefixlen_s = 128 usersa.family = AF_INET</p> <p>Because of the AF_UNSPEC selector, verify_newsa_info doesn&#39;t put limits on prefixlen_{s,d}. But then copy_from_user_state sets x-&gt;sel.family to usersa.family (AF_INET). Do the same conversion in verify_newsa_info before validating prefixlen_{s,d}, since that&#39;s how prefixlen is going to be used later on.</p> https://cve.radiocsirt.org/vuln/cve-2024-50142