| Message ID | 20230828132107.18376-1-wander@redhat.com (mailing list archive) |
|---|---|
| State | Awaiting Upstream |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | [nf] netfilter/xt_u32: validate user space input | expand |
+stable as I forgot to add it in the Cc section. On Mon, Aug 28, 2023 at 10:21 AM Wander Lairson Costa <wander@redhat.com> wrote: > > The xt_u32 module doesn't validate the fields in the xt_u32 structure. > An attacker may take advantage of this to trigger an OOB read by setting > the size fields with a value beyond the arrays boundaries. > > Add a checkentry function to validate the structure. > > This was originally reported by the ZDI project (ZDI-CAN-18408). > > Fixes: 1b50b8a371e9 ("[NETFILTER]: Add u32 match") > Signed-off-by: Wander Lairson Costa <wander@redhat.com> > --- > net/netfilter/xt_u32.c | 21 +++++++++++++++++++++ > 1 file changed, 21 insertions(+) > > diff --git a/net/netfilter/xt_u32.c b/net/netfilter/xt_u32.c > index 177b40d08098..117d4615d668 100644 > --- a/net/netfilter/xt_u32.c > +++ b/net/netfilter/xt_u32.c > @@ -96,11 +96,32 @@ static bool u32_mt(const struct sk_buff *skb, struct xt_action_param *par) > return ret ^ data->invert; > } > > +static int u32_mt_checkentry(const struct xt_mtchk_param *par) > +{ > + const struct xt_u32 *data = par->matchinfo; > + const struct xt_u32_test *ct; > + unsigned int i; > + > + if (data->ntests > ARRAY_SIZE(data->tests)) > + return -EINVAL; > + > + for (i = 0; i < data->ntests; ++i) { > + ct = &data->tests[i]; > + > + if (ct->nnums > ARRAY_SIZE(ct->location) || > + ct->nvalues > ARRAY_SIZE(ct->value)) > + return -EINVAL; > + } > + > + return 0; > +} > + > static struct xt_match xt_u32_mt_reg __read_mostly = { > .name = "u32", > .revision = 0, > .family = NFPROTO_UNSPEC, > .match = u32_mt, > + .checkentry = u32_mt_checkentry, > .matchsize = sizeof(struct xt_u32), > .me = THIS_MODULE, > }; > -- > 2.41.0 >
On Mon, Aug 28, 2023 at 10:21:07AM -0300, Wander Lairson Costa wrote: > The xt_u32 module doesn't validate the fields in the xt_u32 structure. > An attacker may take advantage of this to trigger an OOB read by setting > the size fields with a value beyond the arrays boundaries. > > Add a checkentry function to validate the structure. > > This was originally reported by the ZDI project (ZDI-CAN-18408). Applied to nf, thanks
diff --git a/net/netfilter/xt_u32.c b/net/netfilter/xt_u32.c index 177b40d08098..117d4615d668 100644 --- a/net/netfilter/xt_u32.c +++ b/net/netfilter/xt_u32.c @@ -96,11 +96,32 @@ static bool u32_mt(const struct sk_buff *skb, struct xt_action_param *par) return ret ^ data->invert; } +static int u32_mt_checkentry(const struct xt_mtchk_param *par) +{ + const struct xt_u32 *data = par->matchinfo; + const struct xt_u32_test *ct; + unsigned int i; + + if (data->ntests > ARRAY_SIZE(data->tests)) + return -EINVAL; + + for (i = 0; i < data->ntests; ++i) { + ct = &data->tests[i]; + + if (ct->nnums > ARRAY_SIZE(ct->location) || + ct->nvalues > ARRAY_SIZE(ct->value)) + return -EINVAL; + } + + return 0; +} + static struct xt_match xt_u32_mt_reg __read_mostly = { .name = "u32", .revision = 0, .family = NFPROTO_UNSPEC, .match = u32_mt, + .checkentry = u32_mt_checkentry, .matchsize = sizeof(struct xt_u32), .me = THIS_MODULE, };
The xt_u32 module doesn't validate the fields in the xt_u32 structure. An attacker may take advantage of this to trigger an OOB read by setting the size fields with a value beyond the arrays boundaries. Add a checkentry function to validate the structure. This was originally reported by the ZDI project (ZDI-CAN-18408). Fixes: 1b50b8a371e9 ("[NETFILTER]: Add u32 match") Signed-off-by: Wander Lairson Costa <wander@redhat.com> --- net/netfilter/xt_u32.c | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+)