Re: [SECURITY] netfilter: nft_limit byte-rate bypass via unchecked u64 multiplication

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Sun, Oct 11, 2026 at 11:43:52PM +0200, Pablo Neira Ayuso wrote:
> On Sun, Oct 11, 2026 at 10:27:07PM +0100, SaifAllah benMassaoud wrote:
> > The fact that the kernel does not crash does not, by itself, determine
> > whether a bug is security-relevant ( I mean that a security vulnerability
> > does not have to crash the kernel to be a security issue) .
> > 
> > My PoC demonstrates that the byte-rate limit can be bypassed due to an
> > arithmetic overflow, allowing traffic that should have been rate-limited to
> > pass.
> > I understand that bytes/week is an unusual configuration.
> 
> It is the user itself that configured this esoteric ratelimit...
> 
> > However, nftables accepts it, and the issue is that the kernel
> > incorrectly enforces the resulting rule. If this configuration is
> > not intended to be supported, rejecting it would be a reasonable
> > fix.
> > My question is whether the security implications of the demonstrated
> > rate-limit bypass were evaluated, rather than whether this is a common
> > rate-limit configuration.
> 
> We are busy handling _real_ issues, please stop the bullshit.

Apologies for the blunt, this went a bit far on emphasizing what my
point it when categorizing this bug.

I agree this is a control plane bug. And I agree a much better
behaviour is to reject it upfront via EOVERFLOW too, so user does not
get unexpect behaviour for this corner case configuration.

Let's please just focus on materialising this in a fix patch.

Thanks.