64 lines
2.1 KiB
Diff
64 lines
2.1 KiB
Diff
From 036bd76b11980194badfb3b281a0307b4f6be7df Mon Sep 17 00:00:00 2001
|
|
From: Florian Westphal <fw@strlen.de>
|
|
Date: Wed, 19 Jul 2023 21:08:21 +0200
|
|
Subject: [PATCH 4/6] netfilter: nft_set_pipapo: fix improper element removal
|
|
|
|
end key should be equal to start unless NFT_SET_EXT_KEY_END is present.
|
|
|
|
Its possible to add elements that only have a start key
|
|
("{ 1.0.0.0 . 2.0.0.0 }") without an internval end.
|
|
|
|
Insertion treats this via:
|
|
|
|
if (nft_set_ext_exists(ext, NFT_SET_EXT_KEY_END))
|
|
end = (const u8 *)nft_set_ext_key_end(ext)->data;
|
|
else
|
|
end = start;
|
|
|
|
but removal side always uses nft_set_ext_key_end().
|
|
This is wrong and leads to garbage remaining in the set after removal
|
|
next lookup/insert attempt will give:
|
|
|
|
BUG: KASAN: slab-use-after-free in pipapo_get+0x8eb/0xb90
|
|
Read of size 1 at addr ffff888100d50586 by task nft-pipapo_uaf_/1399
|
|
Call Trace:
|
|
kasan_report+0x105/0x140
|
|
pipapo_get+0x8eb/0xb90
|
|
nft_pipapo_insert+0x1dc/0x1710
|
|
nf_tables_newsetelem+0x31f5/0x4e00
|
|
..
|
|
|
|
Fixes: 3c4287f62044 ("nf_tables: Add set type for arbitrary concatenation of ranges")
|
|
Reported-by: lonial con <kongln9170@gmail.com>
|
|
Reviewed-by: Stefano Brivio <sbrivio@redhat.com>
|
|
Signed-off-by: Florian Westphal <fw@strlen.de>
|
|
(cherry picked from commit 87b5a5c209405cb6b57424cdfa226a6dbd349232)
|
|
|
|
CVE: CVE-2023-4004
|
|
Signed-off-by: Mridula Shastry <mridula.c.shastry@oracle.com>
|
|
Reviewed-by: Venkat Venkatsubra <venkat.x.venkatsubra@oracle.com>
|
|
---
|
|
net/netfilter/nft_set_pipapo.c | 6 +++++-
|
|
1 file changed, 5 insertions(+), 1 deletion(-)
|
|
|
|
diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c
|
|
index 1eab335fb14b..0181617f9628 100644
|
|
--- a/net/netfilter/nft_set_pipapo.c
|
|
+++ b/net/netfilter/nft_set_pipapo.c
|
|
@@ -1797,7 +1797,11 @@ static void nft_pipapo_remove(const struct net *net, const struct nft_set *set,
|
|
int i, start, rules_fx;
|
|
|
|
match_start = data;
|
|
- match_end = (const u8 *)nft_set_ext_key_end(&e->ext)->data;
|
|
+
|
|
+ if (nft_set_ext_exists(&e->ext, NFT_SET_EXT_KEY_END))
|
|
+ match_end = (const u8 *)nft_set_ext_key_end(&e->ext)->data;
|
|
+ else
|
|
+ match_end = data;
|
|
|
|
start = first_rule;
|
|
rules_fx = rules_f0;
|
|
--
|
|
2.39.3
|
|
|