Weiming Shi

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** An issue exists in the netfilter `arp tables` component regarding the parsing of ARP payloads for IEEE1394 (FireWire) interfaces. The `arp packet match()` function incorrectly assumes that both source and target hardware addresses are present, whereas IPv4-over-IEEE1394 ARP (RFC 2734) omits the target hardware address. This causes the function to read incorrect bytes for target device address and target IP address comparisons, leading to incorrect filtering decisions where packets may be dropped or accepted erroneously. Additionally, the `arpt mangle` function uses linear pointer arithmetic that miscalculates the offset for the target IP address on IEEE1394 devices. This results in mangling operations writing to the wrong memory location, causing packet corruption. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** A flaw exists in the netfilter x tables component where `xt match` and `xt target` structures registered with `NFPROTO UNSPEC` can be loaded by any protocol family via `nft compat`. When these structures use a bitmask with `NF INET *` constants to restrict hooks, the validation incorrectly passes for the ARP protocol because `NF ARP OUT` shares the same value as `NF INET LOCAL IN`. This allows matches to execute on ARP chains where expected hook assumptions are not met, potentially leading to NULL pointer dereferences, as seen in the `devgroup mt()` function. **Recommendations** Restrict arptables to use only `NFPROTO ARP` extensions. As a temporary workaround, restrict the use of `xt devgroup` in ARP chains until the update is applied.

**Name of the Vulnerable Software and Affected Versions** D-Link DNS-320 FW version 2.06B01 Revision Ax **Description** The issue is related to command injection in the system mgr.cgi component, which can lead to remote arbitrary code execution. This occurs due to errors in neutralizing special elements in the OS command. The exploitation of this issue can allow a remote attacker to execute arbitrary code. **Recommendations** For D-Link DNS-320 FW version 2.06B01 Revision Ax, consider disabling the system mgr.cgi component as a temporary workaround until a patch is available. Restrict access to this component to minimize the risk of exploitation.