CVE-2024-50142

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> xfrm: validate new SA&amp;#39;s prefixlen using SA family when sel.family is unset<br /> <br /> This expands the validation introduced in commit 07bf7908950a ("xfrm:<br /> Validate address prefix lengths in the xfrm selector.")<br /> <br /> syzbot created an SA with<br /> usersa.sel.family = AF_UNSPEC<br /> usersa.sel.prefixlen_s = 128<br /> usersa.family = AF_INET<br /> <br /> Because of the AF_UNSPEC selector, verify_newsa_info doesn&amp;#39;t put<br /> limits on prefixlen_{s,d}. But then copy_from_user_state sets<br /> x-&gt;sel.family to usersa.family (AF_INET). Do the same conversion in<br /> verify_newsa_info before validating prefixlen_{s,d}, since that&amp;#39;s how<br /> prefixlen is going to be used later on.