[PATCH] netfilter: nfnetlink: fix uninitialized local variable

[PATCH] netfilter: nfnetlink: fix uninitialized local variable

[icejl]

In the nfnetlink_rcv_batch function, an uninitialized local variable
extack is used, which results in using random stack data as a pointer.
This pointer is then used to access the data it points to and return
it as the request status, leading to an information leak. If the stack
data happens to be an invalid pointer, it can cause a pointer access
exception, triggering a kernel crash.

Signed-off-by: icejl <icejl0001@gmail.com>
---
 net/netfilter/nfnetlink.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/net/netfilter/nfnetlink.c b/net/netfilter/nfnetlink.c
index 4abf660c7baf..b29b281f4b2c 100644
--- a/net/netfilter/nfnetlink.c
+++ b/net/netfilter/nfnetlink.c
@@ -427,6 +427,7 @@ static void nfnetlink_rcv_batch(struct sk_buff *skb, struct nlmsghdr *nlh,
 
 	nfnl_unlock(subsys_id);
 
+	memset(&extack, 0, sizeof(extack));
 	if (nlh->nlmsg_flags & NLM_F_ACK)
 		nfnl_err_add(&err_list, nlh, 0, &extack);
 
-- 
2.34.1

Re: [PATCH] netfilter: nfnetlink: fix uninitialized local variable

[Pablo Neira Ayuso]

There is a fix already traveling for this in a pull request.

On Thu, Aug 15, 2024 at 04:27:33PM +0800, icejl wrote:
> In the nfnetlink_rcv_batch function, an uninitialized local variable
> extack is used, which results in using random stack data as a pointer.
> This pointer is then used to access the data it points to and return
> it as the request status, leading to an information leak. If the stack
> data happens to be an invalid pointer, it can cause a pointer access
> exception, triggering a kernel crash.
> 
> Signed-off-by: icejl <icejl0001@gmail.com>
> ---
>  net/netfilter/nfnetlink.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/net/netfilter/nfnetlink.c b/net/netfilter/nfnetlink.c
> index 4abf660c7baf..b29b281f4b2c 100644
> --- a/net/netfilter/nfnetlink.c
> +++ b/net/netfilter/nfnetlink.c
> @@ -427,6 +427,7 @@ static void nfnetlink_rcv_batch(struct sk_buff *skb, struct nlmsghdr *nlh,
>  
>  	nfnl_unlock(subsys_id);
>  
> +	memset(&extack, 0, sizeof(extack));
>  	if (nlh->nlmsg_flags & NLM_F_ACK)
>  		nfnl_err_add(&err_list, nlh, 0, &extack);
>  
> -- 
> 2.34.1
> 

Re: [PATCH] netfilter: nfnetlink: fix uninitialized local variable

[Pablo Neira Ayuso]

For the record:

https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git/commit/?id=d1a7b382a9d3f0f3e5a80e0be2991c075fa4f618

Fixes: bf2ac490d28c ("netfilter: nfnetlink: Handle ACK flags for batch messages")

On Thu, Aug 15, 2024 at 10:32:11AM +0200, Pablo Neira Ayuso wrote:
> There is a fix already traveling for this in a pull request.
> 
> On Thu, Aug 15, 2024 at 04:27:33PM +0800, icejl wrote:
> > In the nfnetlink_rcv_batch function, an uninitialized local variable
> > extack is used, which results in using random stack data as a pointer.
> > This pointer is then used to access the data it points to and return
> > it as the request status, leading to an information leak. If the stack
> > data happens to be an invalid pointer, it can cause a pointer access
> > exception, triggering a kernel crash.
> > 
> > Signed-off-by: icejl <icejl0001@gmail.com>
> > ---
> >  net/netfilter/nfnetlink.c | 1 +
> >  1 file changed, 1 insertion(+)
> > 
> > diff --git a/net/netfilter/nfnetlink.c b/net/netfilter/nfnetlink.c
> > index 4abf660c7baf..b29b281f4b2c 100644
> > --- a/net/netfilter/nfnetlink.c
> > +++ b/net/netfilter/nfnetlink.c
> > @@ -427,6 +427,7 @@ static void nfnetlink_rcv_batch(struct sk_buff *skb, struct nlmsghdr *nlh,
> >  
> >  	nfnl_unlock(subsys_id);
> >  
> > +	memset(&extack, 0, sizeof(extack));
> >  	if (nlh->nlmsg_flags & NLM_F_ACK)
> >  		nfnl_err_add(&err_list, nlh, 0, &extack);
> >  
> > -- 
> > 2.34.1
> > 

Re: [PATCH] netfilter: nfnetlink: fix uninitialized local variable

[Breno Leitao]

On Thu, Aug 15, 2024 at 04:27:33PM +0800, icejl wrote:
> In the nfnetlink_rcv_batch function, an uninitialized local variable
> extack is used, which results in using random stack data as a pointer.
> This pointer is then used to access the data it points to and return
> it as the request status, leading to an information leak. If the stack
> data happens to be an invalid pointer, it can cause a pointer access
> exception, triggering a kernel crash.
> 
> Signed-off-by: icejl <icejl0001@gmail.com>
> ---
>  net/netfilter/nfnetlink.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/net/netfilter/nfnetlink.c b/net/netfilter/nfnetlink.c
> index 4abf660c7baf..b29b281f4b2c 100644
> --- a/net/netfilter/nfnetlink.c
> +++ b/net/netfilter/nfnetlink.c
> @@ -427,6 +427,7 @@ static void nfnetlink_rcv_batch(struct sk_buff *skb, struct nlmsghdr *nlh,
>  
>  	nfnl_unlock(subsys_id);
>  
> +	memset(&extack, 0, sizeof(extack));
>  	if (nlh->nlmsg_flags & NLM_F_ACK)
>  		nfnl_err_add(&err_list, nlh, 0, &extack);

There is a memset later in that function , inside the 
`while (skb->len >= nlmsg_total_size(0))` loop. Should that one be
removed?

Re: [PATCH] netfilter: nfnetlink: fix uninitialized local variable

[Pablo Neira Ayuso]

On Thu, Aug 15, 2024 at 02:04:04AM -0700, Breno Leitao wrote:
> On Thu, Aug 15, 2024 at 04:27:33PM +0800, icejl wrote:
> > In the nfnetlink_rcv_batch function, an uninitialized local variable
> > extack is used, which results in using random stack data as a pointer.
> > This pointer is then used to access the data it points to and return
> > it as the request status, leading to an information leak. If the stack
> > data happens to be an invalid pointer, it can cause a pointer access
> > exception, triggering a kernel crash.
> > 
> > Signed-off-by: icejl <icejl0001@gmail.com>
> > ---
> >  net/netfilter/nfnetlink.c | 1 +
> >  1 file changed, 1 insertion(+)
> > 
> > diff --git a/net/netfilter/nfnetlink.c b/net/netfilter/nfnetlink.c
> > index 4abf660c7baf..b29b281f4b2c 100644
> > --- a/net/netfilter/nfnetlink.c
> > +++ b/net/netfilter/nfnetlink.c
> > @@ -427,6 +427,7 @@ static void nfnetlink_rcv_batch(struct sk_buff *skb, struct nlmsghdr *nlh,
> >  
> >  	nfnl_unlock(subsys_id);
> >  
> > +	memset(&extack, 0, sizeof(extack));
> >  	if (nlh->nlmsg_flags & NLM_F_ACK)
> >  		nfnl_err_add(&err_list, nlh, 0, &extack);
> 
> There is a memset later in that function , inside the 
> `while (skb->len >= nlmsg_total_size(0))` loop. Should that one be
> removed?

no, the batch contains a series of netlink message, each of them needs
a fresh extack area which is zeroed.

this pointer leak only affects the recently released 6.10, older
kernels are not affected.

Re: [PATCH] netfilter: nfnetlink: fix uninitialized local variable

[Breno Leitao]

Hello Pablo,

On Thu, Aug 15, 2024 at 11:32:51AM +0200, Pablo Neira Ayuso wrote:
> On Thu, Aug 15, 2024 at 02:04:04AM -0700, Breno Leitao wrote:
> > On Thu, Aug 15, 2024 at 04:27:33PM +0800, icejl wrote:
> > > In the nfnetlink_rcv_batch function, an uninitialized local variable
> > > extack is used, which results in using random stack data as a pointer.
> > > This pointer is then used to access the data it points to and return
> > > it as the request status, leading to an information leak. If the stack
> > > data happens to be an invalid pointer, it can cause a pointer access
> > > exception, triggering a kernel crash.
> > > 
> > > Signed-off-by: icejl <icejl0001@gmail.com>
> > > ---
> > >  net/netfilter/nfnetlink.c | 1 +
> > >  1 file changed, 1 insertion(+)
> > > 
> > > diff --git a/net/netfilter/nfnetlink.c b/net/netfilter/nfnetlink.c
> > > index 4abf660c7baf..b29b281f4b2c 100644
> > > --- a/net/netfilter/nfnetlink.c
> > > +++ b/net/netfilter/nfnetlink.c
> > > @@ -427,6 +427,7 @@ static void nfnetlink_rcv_batch(struct sk_buff *skb, struct nlmsghdr *nlh,
> > >  
> > >  	nfnl_unlock(subsys_id);
> > >  
> > > +	memset(&extack, 0, sizeof(extack));
> > >  	if (nlh->nlmsg_flags & NLM_F_ACK)
> > >  		nfnl_err_add(&err_list, nlh, 0, &extack);
> > 
> > There is a memset later in that function , inside the 
> > `while (skb->len >= nlmsg_total_size(0))` loop. Should that one be
> > removed?
> 
> no, the batch contains a series of netlink message, each of them needs
> a fresh extack area which is zeroed.

Sorry, this is a bit unclear to me. This is the code I see in
netnext/main:


	memset(&extack, 0, sizeof(extack));   // YOUR CHANGE

        if (nlh->nlmsg_flags & NLM_F_ACK)
                nfnl_err_add(&err_list, nlh, 0, &extack);

        while (skb->len >= nlmsg_total_size(0)) {
                int msglen, type;

                if (fatal_signal_pending(current)) {
                        nfnl_err_reset(&err_list);
                        err = -EINTR;
                        status = NFNL_BATCH_FAILURE;
                        goto done;
                }

->              memset(&extack, 0, sizeof(extack));


nfnl_err_add() does not change extack. Tht said, the second memset (last
line in the snippet above), seems useless, doesn't it?

Thanks for the quick reply,
--breno

Re: [PATCH] netfilter: nfnetlink: fix uninitialized local variable

[Pablo Neira Ayuso]

On Thu, Aug 15, 2024 at 02:55:19AM -0700, Breno Leitao wrote:
> Hello Pablo,
> 
> On Thu, Aug 15, 2024 at 11:32:51AM +0200, Pablo Neira Ayuso wrote:
> > On Thu, Aug 15, 2024 at 02:04:04AM -0700, Breno Leitao wrote:
> > > On Thu, Aug 15, 2024 at 04:27:33PM +0800, icejl wrote:
> > > > In the nfnetlink_rcv_batch function, an uninitialized local variable
> > > > extack is used, which results in using random stack data as a pointer.
> > > > This pointer is then used to access the data it points to and return
> > > > it as the request status, leading to an information leak. If the stack
> > > > data happens to be an invalid pointer, it can cause a pointer access
> > > > exception, triggering a kernel crash.
> > > > 
> > > > Signed-off-by: icejl <icejl0001@gmail.com>
> > > > ---
> > > >  net/netfilter/nfnetlink.c | 1 +
> > > >  1 file changed, 1 insertion(+)
> > > > 
> > > > diff --git a/net/netfilter/nfnetlink.c b/net/netfilter/nfnetlink.c
> > > > index 4abf660c7baf..b29b281f4b2c 100644
> > > > --- a/net/netfilter/nfnetlink.c
> > > > +++ b/net/netfilter/nfnetlink.c
> > > > @@ -427,6 +427,7 @@ static void nfnetlink_rcv_batch(struct sk_buff *skb, struct nlmsghdr *nlh,
> > > >  
> > > >  	nfnl_unlock(subsys_id);
> > > >  
> > > > +	memset(&extack, 0, sizeof(extack));
> > > >  	if (nlh->nlmsg_flags & NLM_F_ACK)
> > > >  		nfnl_err_add(&err_list, nlh, 0, &extack);
> > > 
> > > There is a memset later in that function , inside the 
> > > `while (skb->len >= nlmsg_total_size(0))` loop. Should that one be
> > > removed?
> > 
> > no, the batch contains a series of netlink message, each of them needs
> > a fresh extack area which is zeroed.
> 
> Sorry, this is a bit unclear to me. This is the code I see in
> netnext/main:
> 
> 
> 	memset(&extack, 0, sizeof(extack));   // YOUR CHANGE
> 
>         if (nlh->nlmsg_flags & NLM_F_ACK)
>                 nfnl_err_add(&err_list, nlh, 0, &extack);
> 
>         while (skb->len >= nlmsg_total_size(0)) {
>                 int msglen, type;
> 
>                 if (fatal_signal_pending(current)) {
>                         nfnl_err_reset(&err_list);
>                         err = -EINTR;
>                         status = NFNL_BATCH_FAILURE;
>                         goto done;
>                 }
> 
> ->              memset(&extack, 0, sizeof(extack));
> 
> 
> nfnl_err_add() does not change extack. Tht said, the second memset (last
> line in the snippet above), seems useless, doesn't it?

Processing continues on error, several errors can be reported to
userspace.

        message A1 fails (set extack)
        ...
        message An fails too (but does not set extack)

if extack is not reset, then message B gets a misleading error report
that was set by message A.

Some error paths do not set extack, eg. EINVAL.