From: Pablo Neira Ayuso <pablo@netfilter.org>
To: William Mcvicker <willmcvicker@google.com>
Cc: security@kernel.org, Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>,
Florian Westphal <fw@strlen.de>,
"David S. Miller" <davem@davemloft.net>,
Alexey Kuznetsov <kuznet@ms2.inr.ac.ru>,
Hideaki YOSHIFUJI <yoshfuji@linux-ipv6.org>,
netfilter-devel@vger.kernel.org, coreteam@netfilter.org,
netdev@vger.kernel.org, linux-kernel@vger.kernel.org,
kernel-team@android.com, stable@vger.kernel.org
Subject: Re: [PATCH v2 1/1] netfilter: nat: add a range check for l3/l4 protonum
Date: Tue, 4 Aug 2020 13:37:11 +0200 [thread overview]
Message-ID: <20200804113711.GA20988@salvia> (raw)
In-Reply-To: <20200803183156.GA3084830@google.com>
Hi,
This patch is much smaller and if you confirm this is address the
issue, then this is awesome.
On Mon, Aug 03, 2020 at 06:31:56PM +0000, William Mcvicker wrote:
[...]
> diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
> index 31fa94064a62..56d310f8b29a 100644
> --- a/net/netfilter/nf_conntrack_netlink.c
> +++ b/net/netfilter/nf_conntrack_netlink.c
> @@ -1129,6 +1129,8 @@ ctnetlink_parse_tuple(const struct nlattr * const cda[],
> if (!tb[CTA_TUPLE_IP])
> return -EINVAL;
>
> + if (l3num >= NFPROTO_NUMPROTO)
> + return -EINVAL;
l3num can only be either NFPROTO_IPV4 or NFPROTO_IPV6.
Other than that, bail out with EOPNOTSUPP.
Thank you.
next prev parent reply other threads:[~2020-08-04 11:37 UTC|newest]
Thread overview: 20+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-07-27 17:57 [PATCH 0/1] Netfilter OOB memory access security patch Will McVicker
2020-07-27 17:57 ` [PATCH 1/1] netfilter: nat: add range checks for access to nf_nat_l[34]protos[] Will McVicker
2020-07-27 19:07 ` [PATCH 0/1] Netfilter OOB memory access security patch Will McVicker
2020-07-27 19:07 ` Will McVicker
2020-08-20 8:23 ` Greg KH
2020-08-24 17:52 ` William Mcvicker
2020-07-27 19:07 ` [PATCH 1/1] netfilter: nat: add range checks for access to nf_nat_l[34]protos[] Will McVicker
2020-07-29 21:46 ` Pablo Neira Ayuso
2020-07-31 0:26 ` William Mcvicker
2020-07-31 17:51 ` Pablo Neira Ayuso
2020-07-31 18:16 ` William Mcvicker
2020-08-03 18:31 ` [PATCH v2 1/1] netfilter: nat: add a range check for l3/l4 protonum William Mcvicker
2020-08-04 11:37 ` Pablo Neira Ayuso [this message]
2020-08-24 19:38 ` [PATCH v3 0/1] " Will McVicker
2020-08-24 19:38 ` [PATCH v3 1/1] " Will McVicker
2020-08-28 16:42 ` Pablo Neira Ayuso
2020-08-28 16:45 ` Florian Westphal
2020-08-28 17:11 ` Pablo Neira Ayuso
2020-09-01 15:36 ` [PATCH v2 " Will Deacon
2020-09-01 17:29 ` William Mcvicker
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200804113711.GA20988@salvia \
--to=pablo@netfilter.org \
--cc=coreteam@netfilter.org \
--cc=davem@davemloft.net \
--cc=fw@strlen.de \
--cc=kadlec@blackhole.kfki.hu \
--cc=kernel-team@android.com \
--cc=kuznet@ms2.inr.ac.ru \
--cc=linux-kernel@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=netfilter-devel@vger.kernel.org \
--cc=security@kernel.org \
--cc=stable@vger.kernel.org \
--cc=willmcvicker@google.com \
--cc=yoshfuji@linux-ipv6.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.