* [PATCH nf] netfilter: nfnetlink_acct: validate NFACCT_QUOTA parameter
@ 2016-05-03 20:39 Phil Turnbull
2016-05-05 13:43 ` Pablo Neira Ayuso
0 siblings, 1 reply; 2+ messages in thread
From: Phil Turnbull @ 2016-05-03 20:39 UTC (permalink / raw)
To: netfilter-devel
Cc: Pablo Neira Ayuso, Patrick McHardy, Jozsef Kadlecsik, coreteam,
Phil Turnbull
If a quota bit is set in NFACCT_FLAGS but the NFACCT_QUOTA parameter is
missing then a NULL pointer dereference is triggered. CAP_NET_ADMIN is
required to trigger the bug.
Signed-off-by: Phil Turnbull <phil.turnbull@oracle.com>
---
net/netfilter/nfnetlink_acct.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/net/netfilter/nfnetlink_acct.c b/net/netfilter/nfnetlink_acct.c
index 4c2b4c0..dbd0803 100644
--- a/net/netfilter/nfnetlink_acct.c
+++ b/net/netfilter/nfnetlink_acct.c
@@ -96,6 +96,8 @@ static int nfnl_acct_new(struct net *net, struct sock *nfnl,
return -EINVAL;
if (flags & NFACCT_F_OVERQUOTA)
return -EINVAL;
+ if ((flags & NFACCT_F_QUOTA) && !tb[NFACCT_QUOTA])
+ return -EINVAL;
size += sizeof(u64);
}
--
2.8.0
^ permalink raw reply related [flat|nested] 2+ messages in thread
end of thread, other threads:[~2016-05-05 13:43 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2016-05-03 20:39 [PATCH nf] netfilter: nfnetlink_acct: validate NFACCT_QUOTA parameter Phil Turnbull
2016-05-05 13:43 ` Pablo Neira Ayuso
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).