| Message ID | 20230828221255.124812-1-wander@redhat.com (mailing list archive) |
|---|---|
| State | Awaiting Upstream |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | [nf] netfilter/xt_sctp: validate the flag_info count | expand |
On Mon, Aug 28, 2023 at 07:12:55PM -0300, Wander Lairson Costa wrote: > sctp_mt_check doesn't validate the flag_count field. An attacker can > take advantage of that to trigger a OOB read and leak memory > information. > > Add the field validation in the checkentry function. Applied to nf, thanks
diff --git a/net/netfilter/xt_sctp.c b/net/netfilter/xt_sctp.c index e8961094a282..b46a6a512058 100644 --- a/net/netfilter/xt_sctp.c +++ b/net/netfilter/xt_sctp.c @@ -149,6 +149,8 @@ static int sctp_mt_check(const struct xt_mtchk_param *par) { const struct xt_sctp_info *info = par->matchinfo; + if (info->flag_count > ARRAY_SIZE(info->flag_info)) + return -EINVAL; if (info->flags & ~XT_SCTP_VALID_FLAGS) return -EINVAL; if (info->invflags & ~XT_SCTP_VALID_FLAGS)
sctp_mt_check doesn't validate the flag_count field. An attacker can take advantage of that to trigger a OOB read and leak memory information. Add the field validation in the checkentry function. Fixes: 2e4e6a17af35 ("[NETFILTER] x_tables: Abstraction layer for {ip,ip6,arp}_tables") Reported-by: Lucas Leong <wmliang@infosec.exchange> Cc: stable@kernel.org Signed-off-by: Wander Lairson Costa <wander@redhat.com> --- net/netfilter/xt_sctp.c | 2 ++ 1 file changed, 2 insertions(+)