9bfd50e6dc
Use AlmaLinux OS secure boot cert
Enable Btrfs support for all kernel variants
af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361}
hpsa: bring back deprecated PCI ids #CFHack #CFHack2024
mptsas: bring back deprecated PCI ids #CFHack #CFHack2024
megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024
qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024
qla4xxx: bring back deprecated PCI ids
be2iscsi: bring back deprecated PCI ids
kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained
gve: update QPL page registration logic to honor max_registered_pages (backport from upstream)
gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream)
76 lines
2.6 KiB
Diff
76 lines
2.6 KiB
Diff
From 7fce69f7fa9f3555eec125a06c235b5664b059c8 Mon Sep 17 00:00:00 2001
|
|
From: Florian Westphal <fwestpha@redhat.com>
|
|
Date: Wed, 13 May 2026 17:22:18 +0200
|
|
Subject: [PATCH] netfilter: nfnetlink_osf: fix potential NULL dereference in
|
|
ttl check
|
|
|
|
JIRA: https://redhat.atlassian.net/browse/RHEL-168848
|
|
Upstream Status: commit 711987ba281f
|
|
|
|
commit 711987ba281fd806322a7cd244e98e2a81903114
|
|
Author: Fernando Fernandez Mancera <fmancera@suse.de>
|
|
Date: Fri Apr 17 18:20:57 2026 +0200
|
|
|
|
netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check
|
|
|
|
The nf_osf_ttl() function accessed skb->dev to perform a local interface
|
|
address lookup without verifying that the device pointer was valid.
|
|
|
|
Additionally, the implementation utilized an in_dev_for_each_ifa_rcu
|
|
loop to match the packet source address against local interface
|
|
addresses. It assumed that packets from the same subnet should not see a
|
|
decrement on the initial TTL. A packet might appear it is from the same
|
|
subnet but it actually isn't especially in modern environments with
|
|
containers and virtual switching.
|
|
|
|
Remove the device dereference and interface loop. Replace the logic with
|
|
a switch statement that evaluates the TTL according to the ttl_check.
|
|
|
|
Fixes: 11eeef41d5f6 ("netfilter: passive OS fingerprint xtables match")
|
|
Reported-by: Kito Xu (veritas501) <hxzene@gmail.com>
|
|
Closes: https://lore.kernel.org/netfilter-devel/20260414074556.2512750-1-hxzene@gmail.com/
|
|
Signed-off-by: Fernando Fernandez Mancera <fmancera@suse.de>
|
|
Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
|
|
Signed-off-by: Florian Westphal <fwestpha@redhat.com>
|
|
|
|
diff --git a/net/netfilter/nfnetlink_osf.c b/net/netfilter/nfnetlink_osf.c
|
|
index 832a973..c89efb9 100644
|
|
--- a/net/netfilter/nfnetlink_osf.c
|
|
+++ b/net/netfilter/nfnetlink_osf.c
|
|
@@ -31,26 +31,18 @@ EXPORT_SYMBOL_GPL(nf_osf_fingers);
|
|
static inline int nf_osf_ttl(const struct sk_buff *skb,
|
|
int ttl_check, unsigned char f_ttl)
|
|
{
|
|
- struct in_device *in_dev = __in_dev_get_rcu(skb->dev);
|
|
const struct iphdr *ip = ip_hdr(skb);
|
|
- const struct in_ifaddr *ifa;
|
|
- int ret = 0;
|
|
|
|
- if (ttl_check == NF_OSF_TTL_TRUE)
|
|
+ switch (ttl_check) {
|
|
+ case NF_OSF_TTL_TRUE:
|
|
return ip->ttl == f_ttl;
|
|
- if (ttl_check == NF_OSF_TTL_NOCHECK)
|
|
- return 1;
|
|
- else if (ip->ttl <= f_ttl)
|
|
+ break;
|
|
+ case NF_OSF_TTL_NOCHECK:
|
|
return 1;
|
|
-
|
|
- in_dev_for_each_ifa_rcu(ifa, in_dev) {
|
|
- if (inet_ifa_match(ip->saddr, ifa)) {
|
|
- ret = (ip->ttl == f_ttl);
|
|
- break;
|
|
- }
|
|
+ case NF_OSF_TTL_LESS:
|
|
+ default:
|
|
+ return ip->ttl <= f_ttl;
|
|
}
|
|
-
|
|
- return ret;
|
|
}
|
|
|
|
struct nf_osf_hdr_ctx {
|