[PATCH iptables] nft: bridge: fix among buffer overflow when set has no size

[PATCH iptables] nft: bridge: fix among buffer overflow when set has no size

[Omkhar Arasaratnam]

The among match parser sizes its pair buffer from NFTNL_SET_DESC_SIZE:

        cnt = nftnl_set_get_u32(s, NFTNL_SET_DESC_SIZE);
        ...
        size = cnt * sizeof(struct nft_among_pair);
        match->m = xtables_calloc(1, size);
        ...
        set_elems_to_among_pairs(among_data->pairs + poff, s, cnt);

NFTNL_SET_DESC_SIZE is the hash-table size hint, which is only present
when the set was created with an explicit "size". A set created without
one (e.g. via plain nft: add set bridge filter s { type ether_addr; })
carries no NFTA_SET_DESC_SIZE, so nftnl_set_get_u32() returns 0. The
buffer is then allocated header-only while set_elems_to_among_pairs()
still walks every element of the set and writes one nft_among_pair each,
overflowing the allocation on the first element. Listing such a ruleset
with ebtables-nft -L (or ebtables-nft-restore) corrupts the heap.

Size the buffer from the actual number of set elements instead, i.e.
exactly what set_elems_to_among_pairs() iterates over. Sets created by
the among match itself are unaffected: their element count equals the
NFTNL_SET_DESC_SIZE that was used before.

Fixes: 26753888720d ("nft: bridge: Rudimental among extension support")
Signed-off-by: Omkhar Arasaratnam <omkhar@linkedin.com>
---
 iptables/nft-ruleparse-bridge.c | 22 +++++++++++++++++++++-
 1 file changed, 21 insertions(+), 1 deletion(-)

diff --git a/iptables/nft-ruleparse-bridge.c b/iptables/nft-ruleparse-bridge.c
index aee08b13..fc877d43 100644
--- a/iptables/nft-ruleparse-bridge.c
+++ b/iptables/nft-ruleparse-bridge.c
@@ -306,6 +306,23 @@ static struct nftnl_set *set_from_lookup_expr(struct nft_xt_ctx *ctx,
        return NULL;
 }

+static uint32_t set_elem_count(const struct nftnl_set *s)
+{
+       struct nftnl_set_elems_iter *iter = nftnl_set_elems_iter_create(s);
+       uint32_t cnt = 0;
+
+       if (!iter)
+               xtables_error(OTHER_PROBLEM,
+                             "BUG: set elems iter allocation failed");
+
+       while (nftnl_set_elems_iter_next(iter))
+               cnt++;
+
+       nftnl_set_elems_iter_destroy(iter);
+
+       return cnt;
+}
+
 static void nft_bridge_parse_lookup(struct nft_xt_ctx *ctx,
                                    struct nftnl_expr *e)
 {
@@ -328,7 +345,10 @@ static void nft_bridge_parse_lookup(struct nft_xt_ctx *ctx,
                                    &is_dst, &have_ip))
                return;

-       cnt = nftnl_set_get_u32(s, NFTNL_SET_DESC_SIZE);
+       /* NFTNL_SET_DESC_SIZE is unset for sets without an explicit size, so
+        * count the actual elements instead of trusting it.
+        */
+       cnt = set_elem_count(s);

        for (ematch = ctx->cs->match_list; ematch; ematch = ematch->next) {
                if (!ematch->ismatch || strcmp(ematch->u.match->name, "among"))
--
2.34.1

— oa

Re: [PATCH iptables] nft: bridge: fix among buffer overflow when set has no size

[Pablo Neira Ayuso]

On Fri, Jul 17, 2026 at 06:56:58PM +0000, Omkhar Arasaratnam wrote:
> The among match parser sizes its pair buffer from NFTNL_SET_DESC_SIZE:
> 
>         cnt = nftnl_set_get_u32(s, NFTNL_SET_DESC_SIZE);
>         ...
>         size = cnt * sizeof(struct nft_among_pair);
>         match->m = xtables_calloc(1, size);
>         ...
>         set_elems_to_among_pairs(among_data->pairs + poff, s, cnt);
> 
> NFTNL_SET_DESC_SIZE is the hash-table size hint, which is only present
> when the set was created with an explicit "size". A set created without
> one (e.g. via plain nft: add set bridge filter s { type ether_addr; })
> carries no NFTA_SET_DESC_SIZE, so nftnl_set_get_u32() returns 0. The
> buffer is then allocated header-only while set_elems_to_among_pairs()
> still walks every element of the set and writes one nft_among_pair each,
> overflowing the allocation on the first element. Listing such a ruleset
> with ebtables-nft -L (or ebtables-nft-restore) corrupts the heap.

I assume this is triggered by a crafted set not created by iptables-nft.

Fortify instead set_elems_to_among_pairs() so it does not crash
instead.

> Size the buffer from the actual number of set elements instead, i.e.
> exactly what set_elems_to_among_pairs() iterates over. Sets created by
> the among match itself are unaffected: their element count equals the
> NFTNL_SET_DESC_SIZE that was used before.
>
> Fixes: 26753888720d ("nft: bridge: Rudimental among extension support")
> Signed-off-by: Omkhar Arasaratnam <omkhar@linkedin.com>
> ---
>  iptables/nft-ruleparse-bridge.c | 22 +++++++++++++++++++++-
>  1 file changed, 21 insertions(+), 1 deletion(-)
> 
> diff --git a/iptables/nft-ruleparse-bridge.c b/iptables/nft-ruleparse-bridge.c
> index aee08b13..fc877d43 100644
> --- a/iptables/nft-ruleparse-bridge.c
> +++ b/iptables/nft-ruleparse-bridge.c
> @@ -306,6 +306,23 @@ static struct nftnl_set *set_from_lookup_expr(struct nft_xt_ctx *ctx,
>         return NULL;
>  }
> 
> +static uint32_t set_elem_count(const struct nftnl_set *s)
> +{
> +       struct nftnl_set_elems_iter *iter = nftnl_set_elems_iter_create(s);
> +       uint32_t cnt = 0;
> +
> +       if (!iter)
> +               xtables_error(OTHER_PROBLEM,
> +                             "BUG: set elems iter allocation failed");
> +
> +       while (nftnl_set_elems_iter_next(iter))
> +               cnt++;
> +
> +       nftnl_set_elems_iter_destroy(iter);
> +
> +       return cnt;
> +}
> +
>  static void nft_bridge_parse_lookup(struct nft_xt_ctx *ctx,
>                                     struct nftnl_expr *e)
>  {
> @@ -328,7 +345,10 @@ static void nft_bridge_parse_lookup(struct nft_xt_ctx *ctx,
>                                     &is_dst, &have_ip))
>                 return;
> 
> -       cnt = nftnl_set_get_u32(s, NFTNL_SET_DESC_SIZE);
> +       /* NFTNL_SET_DESC_SIZE is unset for sets without an explicit size, so
> +        * count the actual elements instead of trusting it.
> +        */
> +       cnt = set_elem_count(s);
> 
>         for (ematch = ctx->cs->match_list; ematch; ematch = ematch->next) {
>                 if (!ematch->ismatch || strcmp(ematch->u.match->name, "among"))
> --
> 2.34.1
> 
> — oa