In the Linux kernel, the following vulnerability has been resolved: net: bcmgenet: fix off-by-one in bcmgenet_put_txcb The write_ptr points to the next open tx_cb. We want to return the tx_cb that gets rewinded, so we must rewind the pointer first then return the tx_cb that it points to. That way the txcb can be correctly cleaned up.
The write_ptr pointer points to the next free space in the tx_cb transmit buffer. In the bcmgenet_put_txcb function, the pointer was first returned and only then rewound, which caused an incorrect buffer element to be returned. Correct operation requires first rewinding the pointer and then returning the tx_cb it points to, so it can be properly cleared.
A remote attacker, without authentication, can cause improper memory management in the network driver, which may result in violation of confidentiality, data integrity, and system availability.
Patches available from the manufacturer should be applied according to references — fixes have been published in the Linux kernel stable repository under the indicated commits.
Linux kernel versions containing the bcmgenet driver — specific versions indicated in the manufacturer's references (commits available in the kernel stable repository).
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HLinux Kernel
OSLinux4.134.13.1 – 5.10.258 (excl.)5.11 – 5.15.209 (excl.)5.16 – 6.1.175 (excl.)3.16.50 – 3.17 (excl.)6.7 – 6.12.91 (excl.)6.13 – 6.18.33 (excl.)6.19 – 7.0.10 (excl.)6.2 – 6.6.141 (excl.)
Related vulnerabilities
Type confusion w V8 (Google Chrome) — zdalne uszkodzenie sterty
Commvault Command Center – nieuwierzytelniony RCE przez path traversal w ZIP
RCE przez YAML deserialization w IBM Aspera Faspex
RCE w VMware Workspace ONE Access i Identity Manager poprzez server-side template injection
Command Injection w VMware Workspace One Access i Identity Manager