[PATCH] netfilter: ctnetlink: validate CTA_EXPECT_NAT_DIR value

[PATCH] netfilter: ctnetlink: validate CTA_EXPECT_NAT_DIR value

[Jenny Guanni Qu]

ctnetlink_parse_expect_nat() reads the CTA_EXPECT_NAT_DIR attribute
from userspace via netlink and assigns it to exp->dir without checking
whether it is a valid direction value. Since exp->dir is used as an
array index into the 2-element tuplehash[] array, an out-of-range
value causes an out-of-bounds access.

Add a bounds check to ensure the direction is less than IP_CT_DIR_MAX.

Fixes: 076a0ca02644 ("netfilter: ctnetlink: add NAT support for expectations")
Reported-by: Klaudia Kloc <klaudia@vidocsecurity.com>
Reported-by: Dawid Moczadło <dawid@vidocsecurity.com>
Tested-by: Jenny Guanni Qu <qguanni@gmail.com>
Signed-off-by: Jenny Guanni Qu <qguanni@gmail.com>
---
 net/netfilter/nf_conntrack_netlink.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index 6a1239433830..ddf3a417f408 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -3496,6 +3496,8 @@ ctnetlink_parse_expect_nat(const struct nlattr *attr,
 	exp->saved_addr = nat_tuple.src.u3;
 	exp->saved_proto = nat_tuple.src.u;
 	exp->dir = ntohl(nla_get_be32(tb[CTA_EXPECT_NAT_DIR]));
+	if (exp->dir >= IP_CT_DIR_MAX)
+		return -EINVAL;
 
 	return 0;
 #else
-- 
2.34.1

Re: [PATCH] netfilter: ctnetlink: validate CTA_EXPECT_NAT_DIR value

[Florian Westphal]

Jenny Guanni Qu <qguanni@gmail.com> wrote:
> ctnetlink_parse_expect_nat() reads the CTA_EXPECT_NAT_DIR attribute
> from userspace via netlink and assigns it to exp->dir without checking
> whether it is a valid direction value. Since exp->dir is used as an
> array index into the 2-element tuplehash[] array, an out-of-range
> value causes an out-of-bounds access.
> 
> Add a bounds check to ensure the direction is less than IP_CT_DIR_MAX.

Please see:
https://patchwork.ozlabs.org/project/netfilter-devel/patch/20260310132857.1383-1-fw@strlen.de/

We are seeing a massive influx of bug reports, and sometimes same
issue is reported multiple times.

Due to the large backlog, we are unable to provide timely
pull requests to the net tree anymore.

I hope I can make another pull request with pending patches
this Friday.

We are aware that the conntrack expectation bugs remain
unresolved.

This is because some of the proposed fixes are not sufficient
and a further audit is going on.