* [PATCH] netfilter: ipv4: Fix use-after-free in send_reset
@ 2017-10-23 6:16 Tejaswi Tanikella
2017-11-01 0:36 ` Pablo Neira Ayuso
0 siblings, 1 reply; 3+ messages in thread
From: Tejaswi Tanikella @ 2017-10-23 6:16 UTC (permalink / raw)
To: netfilter-devel, pablo
niph is not updated after pskb_expand_head changes the skb head.
It still points to the freed data, which is then used to update
tot_len and checksum. This could cause use-after-free poison crash.
Update niph, if ip_route_me_harder does not fail.
Signed-off-by: Tejaswi Tanikella <tejaswit@codeaurora.org>
---
net/ipv4/netfilter/nf_reject_ipv4.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/net/ipv4/netfilter/nf_reject_ipv4.c b/net/ipv4/netfilter/nf_reject_ipv4.c
index eeacbda..b2e0f90 100644
--- a/net/ipv4/netfilter/nf_reject_ipv4.c
+++ b/net/ipv4/netfilter/nf_reject_ipv4.c
@@ -131,6 +131,8 @@ void nf_send_reset(struct net *net, struct sk_buff *oldskb, int hook)
if (ip_route_me_harder(net, nskb, RTN_UNSPEC))
goto free_nskb;
+ else
+ niph = ip_hdr(nskb);
/* "Never happens" */
if (nskb->len > dst_mtu(skb_dst(nskb)))
--
1.9.1
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH] netfilter: ipv4: Fix use-after-free in send_reset
2017-10-23 6:16 [PATCH] netfilter: ipv4: Fix use-after-free in send_reset Tejaswi Tanikella
@ 2017-11-01 0:36 ` Pablo Neira Ayuso
2017-11-01 16:59 ` Pablo Neira Ayuso
0 siblings, 1 reply; 3+ messages in thread
From: Pablo Neira Ayuso @ 2017-11-01 0:36 UTC (permalink / raw)
To: Tejaswi Tanikella; +Cc: netfilter-devel
On Mon, Oct 23, 2017 at 11:46:03AM +0530, Tejaswi Tanikella wrote:
> niph is not updated after pskb_expand_head changes the skb head.
> It still points to the freed data, which is then used to update
> tot_len and checksum. This could cause use-after-free poison crash.
>
> Update niph, if ip_route_me_harder does not fail.
>
> Signed-off-by: Tejaswi Tanikella <tejaswit@codeaurora.org>
> ---
> net/ipv4/netfilter/nf_reject_ipv4.c | 2 ++
> 1 file changed, 2 insertions(+)
>
> diff --git a/net/ipv4/netfilter/nf_reject_ipv4.c b/net/ipv4/netfilter/nf_reject_ipv4.c
> index eeacbda..b2e0f90 100644
> --- a/net/ipv4/netfilter/nf_reject_ipv4.c
> +++ b/net/ipv4/netfilter/nf_reject_ipv4.c
> @@ -131,6 +131,8 @@ void nf_send_reset(struct net *net, struct sk_buff *oldskb, int hook)
>
> if (ip_route_me_harder(net, nskb, RTN_UNSPEC))
> goto free_nskb;
> + else
> + niph = ip_hdr(nskb);
No need for else here, right? So we can just turn this into a one
liner to inconditionally reload this pointer.
> /* "Never happens" */
> if (nskb->len > dst_mtu(skb_dst(nskb)))
> --
> 1.9.1
>
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] netfilter: ipv4: Fix use-after-free in send_reset
2017-11-01 0:36 ` Pablo Neira Ayuso
@ 2017-11-01 16:59 ` Pablo Neira Ayuso
0 siblings, 0 replies; 3+ messages in thread
From: Pablo Neira Ayuso @ 2017-11-01 16:59 UTC (permalink / raw)
To: Tejaswi Tanikella; +Cc: netfilter-devel
On Wed, Nov 01, 2017 at 01:36:36AM +0100, Pablo Neira Ayuso wrote:
> On Mon, Oct 23, 2017 at 11:46:03AM +0530, Tejaswi Tanikella wrote:
> > niph is not updated after pskb_expand_head changes the skb head.
> > It still points to the freed data, which is then used to update
> > tot_len and checksum. This could cause use-after-free poison crash.
> >
> > Update niph, if ip_route_me_harder does not fail.
> >
> > Signed-off-by: Tejaswi Tanikella <tejaswit@codeaurora.org>
> > ---
> > net/ipv4/netfilter/nf_reject_ipv4.c | 2 ++
> > 1 file changed, 2 insertions(+)
> >
> > diff --git a/net/ipv4/netfilter/nf_reject_ipv4.c b/net/ipv4/netfilter/nf_reject_ipv4.c
> > index eeacbda..b2e0f90 100644
> > --- a/net/ipv4/netfilter/nf_reject_ipv4.c
> > +++ b/net/ipv4/netfilter/nf_reject_ipv4.c
> > @@ -131,6 +131,8 @@ void nf_send_reset(struct net *net, struct sk_buff *oldskb, int hook)
> >
> > if (ip_route_me_harder(net, nskb, RTN_UNSPEC))
> > goto free_nskb;
> > + else
> > + niph = ip_hdr(nskb);
>
> No need for else here, right? So we can just turn this into a one
> liner to inconditionally reload this pointer.
I'm just going to remove the 'else' and push out this.
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2017-11-01 16:59 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2017-10-23 6:16 [PATCH] netfilter: ipv4: Fix use-after-free in send_reset Tejaswi Tanikella
2017-11-01 0:36 ` Pablo Neira Ayuso
2017-11-01 16:59 ` Pablo Neira Ayuso
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).