CyberRota Analysis
AI-GeneratedThe vulnerability affects the Linux kernel's IP Virtual Server (IPVS) component, specifically in the `ip_vs_ftp_get_addrport()` function, which improperly handles integer overflow during FTP PASV/EPSV response parsing. This flaw allows an attacker to craft a response that can lead to a truncated port or address configuration, potentially disrupting data connections. Organizations utilizing Linux systems with IPVS for FTP services should prioritize this issue to mitigate the risk of exploitation.
Original NVD Description
In the Linux kernel, the following vulnerability has been resolved: ipvs: fix integer overflow in ftp helper port/address parsing ip_vs_ftp_get_addrport() accumulates decimal digits into a __u16 (hport) and into unsigned char (p[]) without checking for overflow. A crafted FTP PASV/EPSV response with an over-long port or address octet wraps the value, so the helper configures the data connection with a truncated port/address. The netfilter conntrack FTP helper had the same defect, fixed in commit 2b413fc689ba ("netfilter: nf_conntrack_ftp: avoid u16 overflows"). Apply the equivalent fix here: widen the port accumulator to u32 and reject values above 65535, and reject address octets above 255.