lkml.org 
[lkml]   [2022]   [Jun]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.14 139/218] netfilter: nf_tables: disallow non-stateful expression in sets earlier
    Date
    From: Pablo Neira Ayuso <pablo@netfilter.org>

    commit 520778042ccca019f3ffa136dd0ca565c486cedd upstream.

    Since 3e135cd499bf ("netfilter: nft_dynset: dynamic stateful expression
    instantiation"), it is possible to attach stateful expressions to set
    elements.

    cd5125d8f518 ("netfilter: nf_tables: split set destruction in deactivate
    and destroy phase") introduces conditional destruction on the object to
    accomodate transaction semantics.

    nft_expr_init() calls expr->ops->init() first, then check for
    NFT_STATEFUL_EXPR, this stills allows to initialize a non-stateful
    lookup expressions which points to a set, which might lead to UAF since
    the set is not properly detached from the set->binding for this case.
    Anyway, this combination is non-sense from nf_tables perspective.

    This patch fixes this problem by checking for NFT_STATEFUL_EXPR before
    expr->ops->init() is called.

    The reporter provides a KASAN splat and a poc reproducer (similar to
    those autogenerated by syzbot to report use-after-free errors). It is
    unknown to me if they are using syzbot or if they use similar automated
    tool to locate the bug that they are reporting.

    For the record, this is the KASAN splat.

    [ 85.431824] ==================================================================
    [ 85.432901] BUG: KASAN: use-after-free in nf_tables_bind_set+0x81b/0xa20
    [ 85.433825] Write of size 8 at addr ffff8880286f0e98 by task poc/776
    [ 85.434756]
    [ 85.434999] CPU: 1 PID: 776 Comm: poc Tainted: G W 5.18.0+ #2
    [ 85.436023] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2 04/01/2014

    Fixes: 0b2d8a7b638b ("netfilter: nf_tables: add helper functions for expression handling")
    Reported-and-tested-by: Aaron Adams <edg-e@nccgroup.com>
    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
    [Ajay: Regenerated the patch for v4.14.y]
    Signed-off-by: Ajay Kaher <akaher@vmware.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    net/netfilter/nf_tables_api.c | 16 ++++++++++------
    net/netfilter/nft_dynset.c | 3 ---
    2 files changed, 10 insertions(+), 9 deletions(-)

    --- a/net/netfilter/nf_tables_api.c
    +++ b/net/netfilter/nf_tables_api.c
    @@ -1952,23 +1952,27 @@ struct nft_expr *nft_expr_init(const str

    err = nf_tables_expr_parse(ctx, nla, &info);
    if (err < 0)
    - goto err1;
    + goto err_expr_parse;
    +
    + err = -EOPNOTSUPP;
    + if (!(info.ops->type->flags & NFT_EXPR_STATEFUL))
    + goto err_expr_stateful;

    err = -ENOMEM;
    expr = kzalloc(info.ops->size, GFP_KERNEL);
    if (expr == NULL)
    - goto err2;
    + goto err_expr_stateful;

    err = nf_tables_newexpr(ctx, &info, expr);
    if (err < 0)
    - goto err3;
    + goto err_expr_new;

    return expr;
    -err3:
    +err_expr_new:
    kfree(expr);
    -err2:
    +err_expr_stateful:
    module_put(info.ops->type->owner);
    -err1:
    +err_expr_parse:
    return ERR_PTR(err);
    }

    --- a/net/netfilter/nft_dynset.c
    +++ b/net/netfilter/nft_dynset.c
    @@ -191,9 +191,6 @@ static int nft_dynset_init(const struct
    if (IS_ERR(priv->expr))
    return PTR_ERR(priv->expr);

    - err = -EOPNOTSUPP;
    - if (!(priv->expr->ops->type->flags & NFT_EXPR_STATEFUL))
    - goto err1;
    } else if (set->flags & NFT_SET_EVAL)
    return -EINVAL;


    \
     
     \ /
      Last update: 2022-06-13 13:00    [W:3.113 / U:0.008 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site