| Message ID | 20240717215214.225394-2-pablo@netfilter.org (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | 782161895eb4ac45cf7cfa8db375bd4766cb8299 |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | [net,1/4] netfilter: ctnetlink: use helper function to calculate expect ID | expand |
Hello: This series was applied to netdev/net.git (main) by Pablo Neira Ayuso <pablo@netfilter.org>: On Wed, 17 Jul 2024 23:52:11 +0200 you wrote: > Delete expectation path is missing a call to the nf_expect_get_id() > helper function to calculate the expectation ID, otherwise LSB of the > expectation object address is leaked to userspace. > > Fixes: 3c79107631db ("netfilter: ctnetlink: don't use conntrack/expect object addresses as id") > Reported-by: zdi-disclosures@trendmicro.com > Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> > > [...] Here is the summary with links: - [net,1/4] netfilter: ctnetlink: use helper function to calculate expect ID https://git.kernel.org/netdev/net/c/782161895eb4 - [net,2/4] netfilter: nf_set_pipapo: fix initial map fill https://git.kernel.org/netdev/net/c/791a615b7ad2 - [net,3/4] selftests: netfilter: add test case for recent mismatch bug https://git.kernel.org/netdev/net/c/0935ee6032df - [net,4/4] ipvs: properly dereference pe in ip_vs_add_service https://git.kernel.org/netdev/net/c/cbd070a4ae62 You are awesome, thank you!
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c index 3b846cbdc050..4cbf71d0786b 100644 --- a/net/netfilter/nf_conntrack_netlink.c +++ b/net/netfilter/nf_conntrack_netlink.c @@ -3420,7 +3420,8 @@ static int ctnetlink_del_expect(struct sk_buff *skb, if (cda[CTA_EXPECT_ID]) { __be32 id = nla_get_be32(cda[CTA_EXPECT_ID]); - if (ntohl(id) != (u32)(unsigned long)exp) { + + if (id != nf_expect_get_id(exp)) { nf_ct_expect_put(exp); return -ENOENT; }
Delete expectation path is missing a call to the nf_expect_get_id() helper function to calculate the expectation ID, otherwise LSB of the expectation object address is leaked to userspace. Fixes: 3c79107631db ("netfilter: ctnetlink: don't use conntrack/expect object addresses as id") Reported-by: zdi-disclosures@trendmicro.com Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> --- net/netfilter/nf_conntrack_netlink.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)