[PATCH nf v2 0/1] netfilter: ip6t_rt: fix zero-address non-strict match out-of-bounds read

[Ren Wei <weir@nebusec.ai>]

From: Luxiao Xu <rakukuip@gmail.com>

Hi Florian, netfilter maintainers,

This patch fixes an out-of-bounds read in net/ipv6/netfilter/ip6t_rt.c
reachable by unprivileged users with CAP_NET_ADMIN in user/net namespaces
when configuring non-strict routing match rules with addrnr == 0.

v1 -> v2:
 - Move the loop termination check (i < rtinfo->addrnr) into the for-loop
   header condition in rt_mt6() and remove the backwards break check at
   the bottom of the loop body (suggested by Florian Westphal).
 - v1 Link: https://lore.kernel.org/all/cover.1788337633.git.rakukuip@gmail.com/

Thanks,
Ren Wei
Luxiao Xu

Luxiao Xu (1):
  netfilter: ip6t_rt: fix zero-address non-strict match  out-of-bounds
    read

 net/ipv6/netfilter/ip6t_rt.c | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

-- 
2.43.0