Re: [PATCH net] netfilter: ctnetlink: validate CTA_EXPECT_NAT_DIR to prevent OOB access

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Sat, Mar 07, 2026 at 07:01:07PM +0100, Florian Westphal wrote:
> Hyunwoo Kim <imv4bel@gmail.com> wrote:
> > ctnetlink_parse_expect_nat() assigns the user-supplied
> > CTA_EXPECT_NAT_DIR value directly to exp->dir without validating that it
> > is within the valid range (0 to IP_CT_DIR_MAX-1).  When
> > nf_nat_sip_expected() later uses exp->dir as an index into
> > ct->master->tuplehash[], an out-of-bounds array access occurs.
> > 
> > For example, with exp->dir = 100, the access at
> > ct->master->tuplehash[100] reads 5600 bytes past the start of a
> > 320-byte nf_conn object, causing a slab-out-of-bounds read confirmed by
> > UBSAN.
> > 
> > Validate exp->dir against IP_CT_DIR_MAX before accepting it.
> 
> I would prefer a fix for exp_nat_nla_policy so netlink policy validation
> can handle this for us.
> 
>         [CTA_EXPECT_NAT_DIR] = NLA_POLICY_MAX(NLA_BE32, IPCT_DIR_MAX),
> 
> .. should do it.  Might make sense to check all other attrs while at it.

Agreed.