CVE-2024-26851

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> netfilter: nf_conntrack_h323: Add protection for bmp length out of range<br /> <br /> UBSAN load reports an exception of BRK#5515 SHIFT_ISSUE:Bitwise shifts<br /> that are out of bounds for their data type.<br /> <br /> vmlinux get_bitmap(b=75) + 712<br /> <br /> vmlinux decode_seq(bs=0xFFFFFFD008037000, f=0xFFFFFFD008037018, level=134443100) + 1956<br /> <br /> vmlinux decode_choice(base=0xFFFFFFD0080370F0, level=23843636) + 1216<br /> <br /> vmlinux decode_seq(f=0xFFFFFFD0080371A8, level=134443500) + 812<br /> <br /> vmlinux decode_choice(base=0xFFFFFFD008037280, level=0) + 1216<br /> <br /> vmlinux DecodeRasMessage() + 304<br /> <br /> vmlinux ras_help() + 684<br /> <br /> vmlinux nf_confirm() + 188<br /> <br /> <br /> Due to abnormal data in skb-&gt;data, the extension bitmap length<br /> exceeds 32 when decoding ras message then uses the length to make<br /> a shift operation. It will change into negative after several loop.<br /> UBSAN load could detect a negative shift as an undefined behaviour<br /> and reports exception.<br /> So we add the protection to avoid the length exceeding 32. Or else<br /> it will return out of range error and stop decoding.