lkml.org 
[lkml]   [2022]   [Aug]   [15]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.15 106/779] netfilter: nf_tables: do not allow SET_ID to refer to another table
    Date
    From: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>

    commit 470ee20e069a6d05ae549f7d0ef2bdbcee6a81b2 upstream.

    When doing lookups for sets on the same batch by using its ID, a set from a
    different table can be used.

    Then, when the table is removed, a reference to the set may be kept after
    the set is freed, leading to a potential use-after-free.

    When looking for sets by ID, use the table that was used for the lookup by
    name, and only return sets belonging to that same table.

    This fixes CVE-2022-2586, also reported as ZDI-CAN-17470.

    Reported-by: Team Orca of Sea Security (@seasecresponse)
    Fixes: 958bee14d071 ("netfilter: nf_tables: use new transaction infrastructure to handle sets")
    Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
    Cc: <stable@vger.kernel.org>
    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    net/netfilter/nf_tables_api.c | 4 +++-
    1 file changed, 3 insertions(+), 1 deletion(-)

    --- a/net/netfilter/nf_tables_api.c
    +++ b/net/netfilter/nf_tables_api.c
    @@ -3745,6 +3745,7 @@ static struct nft_set *nft_set_lookup_by
    }

    static struct nft_set *nft_set_lookup_byid(const struct net *net,
    + const struct nft_table *table,
    const struct nlattr *nla, u8 genmask)
    {
    struct nftables_pernet *nft_net = nft_pernet(net);
    @@ -3756,6 +3757,7 @@ static struct nft_set *nft_set_lookup_by
    struct nft_set *set = nft_trans_set(trans);

    if (id == nft_trans_set_id(trans) &&
    + set->table == table &&
    nft_active_genmask(set, genmask))
    return set;
    }
    @@ -3776,7 +3778,7 @@ struct nft_set *nft_set_lookup_global(co
    if (!nla_set_id)
    return set;

    - set = nft_set_lookup_byid(net, nla_set_id, genmask);
    + set = nft_set_lookup_byid(net, table, nla_set_id, genmask);
    }
    return set;
    }

    \
     
     \ /
      Last update: 2022-08-15 20:28    [W:4.076 / U:0.120 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site