Re: [SECURITY][netfilter][nf_tables] stack out-of-bounds read in nft_set_pipapo pipapo_drop()

Re: [SECURITY][netfilter][nf_tables] stack out-of-bounds read in nft_set_pipapo pipapo_drop()

[Florian Westphal]

钱一铭 <yimingqian591@gmail.com> wrote:
> 2) Root cause explanation
> rulemap is a fixed-size stack array:
> union nft_pipapo_map_bucket rulemap[NFT_PIPAPO_MAX_FIELDS];
> When m->field_count == NFT_PIPAPO_MAX_FIELDS (16), the last iteration has i
> == 15. pipapo_drop() still evaluates:
> rulemap[i + 1].n
> which becomes rulemap[16].n, i.e. out-of-bounds read from stack.
> Important detail: although is_last == true and pipapo_unmap() immediately
> returns, the function argument rulemap[i + 1].n is already evaluated before
> the callee runs. So the OOB read is unconditional in that final iteration.
> ------------------------------
> 3) Reproducer summary
> Userspace netlink PoC sequence:
> 
>    1. NFT_MSG_NEWTABLE
>    2. NFT_MSG_NEWSET with flags NFT_SET_INTERVAL | NFT_SET_CONCAT
>    3. set key length 64
>    4. set concat descriptor with 16 fields, each field length 4
>    5. NFT_MSG_NEWSETELEM add one element
>    6. NFT_MSG_DELSETELEM delete same element
> 
> This reaches:
> nf_tables_delsetelem -> nft_setelem_remove -> nft_pipapo_remove ->
> pipapo_drop

Could you confirm this is fixed by this patch?

https://patchwork.ozlabs.org/project/netfilter-devel/patch/20260306191238.937530-1-qguanni@gmail.com/

Thanks!