lkml.org 
[lkml]   [2022]   [Aug]   [1]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.10 42/65] netfilter: nf_queue: do not allow packet truncation below transport header offset
    Date
    From: Florian Westphal <fw@strlen.de>

    [ Upstream commit 99a63d36cb3ed5ca3aa6fcb64cffbeaf3b0fb164 ]

    Domingo Dirutigliano and Nicola Guerrera report kernel panic when
    sending nf_queue verdict with 1-byte nfta_payload attribute.

    The IP/IPv6 stack pulls the IP(v6) header from the packet after the
    input hook.

    If user truncates the packet below the header size, this skb_pull() will
    result in a malformed skb (skb->len < 0).

    Fixes: 7af4cc3fa158 ("[NETFILTER]: Add "nfnetlink_queue" netfilter queue handler over nfnetlink")
    Reported-by: Domingo Dirutigliano <pwnzer0tt1@proton.me>
    Signed-off-by: Florian Westphal <fw@strlen.de>
    Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    net/netfilter/nfnetlink_queue.c | 7 ++++++-
    1 file changed, 6 insertions(+), 1 deletion(-)

    diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c
    index 1640da5c5077..72d30922ed29 100644
    --- a/net/netfilter/nfnetlink_queue.c
    +++ b/net/netfilter/nfnetlink_queue.c
    @@ -838,11 +838,16 @@ nfqnl_enqueue_packet(struct nf_queue_entry *entry, unsigned int queuenum)
    }

    static int
    -nfqnl_mangle(void *data, int data_len, struct nf_queue_entry *e, int diff)
    +nfqnl_mangle(void *data, unsigned int data_len, struct nf_queue_entry *e, int diff)
    {
    struct sk_buff *nskb;

    if (diff < 0) {
    + unsigned int min_len = skb_transport_offset(e->skb);
    +
    + if (data_len < min_len)
    + return -EINVAL;
    +
    if (pskb_trim(e->skb, data_len))
    return -ENOMEM;
    } else if (diff > 0) {
    --
    2.35.1


    \
     
     \ /
      Last update: 2022-08-01 13:56    [W:4.155 / U:0.024 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site