lkml.org 
[lkml]   [2018]   [Apr]   [8]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH AUTOSEL for 4.14 091/161] netfilter: x_tables: fix pointer leaks to userspace
    Date
    From: Dmitry Vyukov <dvyukov@google.com>

    [ Upstream commit 1e98ffea5a8935ec040ab72299e349cb44b8defd ]

    Several netfilter matches and targets put kernel pointers into
    info objects, but don't set usersize in descriptors.
    This leads to kernel pointer leaks if a match/target is set
    and then read back to userspace.

    Properly set usersize for these matches/targets.

    Found with manual code inspection.

    Fixes: ec2318904965 ("xtables: extend matches and targets with .usersize")
    Signed-off-by: Dmitry Vyukov <dvyukov@google.com>
    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
    Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
    ---
    net/netfilter/xt_IDLETIMER.c | 1 +
    net/netfilter/xt_LED.c | 1 +
    net/netfilter/xt_limit.c | 3 +--
    net/netfilter/xt_nfacct.c | 1 +
    net/netfilter/xt_statistic.c | 1 +
    5 files changed, 5 insertions(+), 2 deletions(-)

    diff --git a/net/netfilter/xt_IDLETIMER.c b/net/netfilter/xt_IDLETIMER.c
    index bb5d6a058fb7..1141f08810b6 100644
    --- a/net/netfilter/xt_IDLETIMER.c
    +++ b/net/netfilter/xt_IDLETIMER.c
    @@ -256,6 +256,7 @@ static struct xt_target idletimer_tg __read_mostly = {
    .family = NFPROTO_UNSPEC,
    .target = idletimer_tg_target,
    .targetsize = sizeof(struct idletimer_tg_info),
    + .usersize = offsetof(struct idletimer_tg_info, timer),
    .checkentry = idletimer_tg_checkentry,
    .destroy = idletimer_tg_destroy,
    .me = THIS_MODULE,
    diff --git a/net/netfilter/xt_LED.c b/net/netfilter/xt_LED.c
    index 0858fe17e14a..2d1c5c169a26 100644
    --- a/net/netfilter/xt_LED.c
    +++ b/net/netfilter/xt_LED.c
    @@ -198,6 +198,7 @@ static struct xt_target led_tg_reg __read_mostly = {
    .family = NFPROTO_UNSPEC,
    .target = led_tg,
    .targetsize = sizeof(struct xt_led_info),
    + .usersize = offsetof(struct xt_led_info, internal_data),
    .checkentry = led_tg_check,
    .destroy = led_tg_destroy,
    .me = THIS_MODULE,
    diff --git a/net/netfilter/xt_limit.c b/net/netfilter/xt_limit.c
    index d27b5f1ea619..61403b77361c 100644
    --- a/net/netfilter/xt_limit.c
    +++ b/net/netfilter/xt_limit.c
    @@ -193,9 +193,8 @@ static struct xt_match limit_mt_reg __read_mostly = {
    .compatsize = sizeof(struct compat_xt_rateinfo),
    .compat_from_user = limit_mt_compat_from_user,
    .compat_to_user = limit_mt_compat_to_user,
    -#else
    - .usersize = offsetof(struct xt_rateinfo, prev),
    #endif
    + .usersize = offsetof(struct xt_rateinfo, prev),
    .me = THIS_MODULE,
    };

    diff --git a/net/netfilter/xt_nfacct.c b/net/netfilter/xt_nfacct.c
    index cc0518fe598e..6f92d25590a8 100644
    --- a/net/netfilter/xt_nfacct.c
    +++ b/net/netfilter/xt_nfacct.c
    @@ -62,6 +62,7 @@ static struct xt_match nfacct_mt_reg __read_mostly = {
    .match = nfacct_mt,
    .destroy = nfacct_mt_destroy,
    .matchsize = sizeof(struct xt_nfacct_match_info),
    + .usersize = offsetof(struct xt_nfacct_match_info, nfacct),
    .me = THIS_MODULE,
    };

    diff --git a/net/netfilter/xt_statistic.c b/net/netfilter/xt_statistic.c
    index 11de55e7a868..8710fdba2ae2 100644
    --- a/net/netfilter/xt_statistic.c
    +++ b/net/netfilter/xt_statistic.c
    @@ -84,6 +84,7 @@ static struct xt_match xt_statistic_mt_reg __read_mostly = {
    .checkentry = statistic_mt_check,
    .destroy = statistic_mt_destroy,
    .matchsize = sizeof(struct xt_statistic_info),
    + .usersize = offsetof(struct xt_statistic_info, master),
    .me = THIS_MODULE,
    };

    --
    2.15.1
    \
     
     \ /
      Last update: 2018-04-09 02:24    [W:3.561 / U:0.060 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site