From: Pavel Machek <pavel@denx.de>
To: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: linux-kernel@vger.kernel.org, stable@vger.kernel.org,
Will McVicker <willmcvicker@google.com>,
Pablo Neira Ayuso <pablo@netfilter.org>
Subject: Re: [PATCH 4.19 38/38] netfilter: ctnetlink: add a range check for l3/l4 protonum
Date: Mon, 5 Oct 2020 22:59:13 +0200 [thread overview]
Message-ID: <20201005205912.GB27782@amd> (raw)
In-Reply-To: <20201005142110.510691312@linuxfoundation.org>
[-- Attachment #1: Type: text/plain, Size: 1086 bytes --]
Hi!
> From: Will McVicker <willmcvicker@google.com>
>
> commit 1cc5ef91d2ff94d2bf2de3b3585423e8a1051cb6 upstream.
>
> The indexes to the nf_nat_l[34]protos arrays come from userspace. So
> check the tuple's family, e.g. l3num, when creating the conntrack in
> order to prevent an OOB memory access during setup. Here is an example
> kernel panic on 4.14.180 when userspace passes in an index greater than
> NFPROTO_NUMPROTO.
Since this protects against OOB array access, should it use _nospec()
variant to protect from speculation attacks?
Best regards,
Pavel
> +++ b/net/netfilter/nf_conntrack_netlink.c
> @@ -1129,6 +1129,8 @@ ctnetlink_parse_tuple(const struct nlatt
> if (!tb[CTA_TUPLE_IP])
> return -EINVAL;
>
> + if (l3num != NFPROTO_IPV4 && l3num != NFPROTO_IPV6)
> + return -EOPNOTSUPP;
> tuple->src.l3num = l3num;
>
> err = ctnetlink_parse_tuple_ip(tb[CTA_TUPLE_IP], tuple);
>
--
(english) http://www.livejournal.com/~pavelmachek
(cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html
[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 181 bytes --]
next prev parent reply other threads:[~2020-10-05 20:59 UTC|newest]
Thread overview: 53+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-10-05 15:26 [PATCH 4.19 00/38] 4.19.150-rc1 review Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 4.19 01/38] mmc: sdhci: Workaround broken command queuing on Intel GLK based IRBIS models Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 4.19 02/38] USB: gadget: f_ncm: Fix NDP16 datagram validation Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 4.19 03/38] gpio: mockup: fix resource leak in error path Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 4.19 04/38] gpio: tc35894: fix up tc35894 interrupt configuration Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 4.19 05/38] clk: socfpga: stratix10: fix the divider for the emac_ptp_free_clk Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 4.19 06/38] vsock/virtio: use RCU to avoid use-after-free on the_virtio_vsock Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 4.19 07/38] vsock/virtio: stop workers during the .remove() Greg Kroah-Hartman
2020-10-06 19:34 ` Pavel Machek
2020-10-07 7:13 ` Stefano Garzarella
2020-10-05 15:26 ` [PATCH 4.19 08/38] vsock/virtio: add transport parameter to the virtio_transport_reset_no_sock() Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 4.19 09/38] net: virtio_vsock: Enhance connection semantics Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 4.19 10/38] Input: i8042 - add nopnp quirk for Acer Aspire 5 A515 Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 4.19 11/38] ftrace: Move RCU is watching check after recursion check Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 4.19 12/38] drm/amdgpu: restore proper ref count in amdgpu_display_crtc_set_config Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 4.19 13/38] drivers/net/wan/hdlc_fr: Add needed_headroom for PVC devices Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 4.19 14/38] drm/sun4i: mixer: Extend regmap max_register Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 4.19 15/38] net: dec: de2104x: Increase receive ring size for Tulip Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 4.19 16/38] rndis_host: increase sleep time in the query-response loop Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 4.19 17/38] nvme-core: get/put ctrl and transport module in nvme_dev_open/release() Greg Kroah-Hartman
2020-10-05 20:58 ` Pavel Machek
2020-10-05 15:26 ` [PATCH 4.19 18/38] drivers/net/wan/lapbether: Make skb->protocol consistent with the header Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 4.19 19/38] drivers/net/wan/hdlc: Set skb->protocol before transmitting Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 4.19 20/38] mac80211: do not allow bigger VHT MPDUs than the hardware supports Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 4.19 21/38] spi: fsl-espi: Only process interrupts for expected events Greg Kroah-Hartman
2020-10-06 19:36 ` Pavel Machek
2020-10-11 19:47 ` Chris Packham
2020-10-11 22:03 ` Pavel Machek
2020-10-05 15:26 ` [PATCH 4.19 22/38] nvme-fc: fail new connections to a deleted host or remote port Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 4.19 23/38] gpio: sprd: Clear interrupt when setting the type as edge Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 4.19 24/38] pinctrl: mvebu: Fix i2c sda definition for 98DX3236 Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 4.19 25/38] nfs: Fix security label length not being reset Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 4.19 26/38] clk: samsung: exynos4: mark chipid clock as CLK_IGNORE_UNUSED Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 4.19 27/38] iommu/exynos: add missing put_device() call in exynos_iommu_of_xlate() Greg Kroah-Hartman
2020-10-07 9:47 ` Pavel Machek
2020-10-13 8:54 ` Marek Szyprowski
2020-10-13 14:14 ` Pavel Machek
2020-10-05 15:26 ` [PATCH 4.19 28/38] i2c: cpm: Fix i2c_ram structure Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 4.19 29/38] Input: trackpoint - enable Synaptics trackpoints Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 4.19 30/38] random32: Restore __latent_entropy attribute on net_rand_state Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 4.19 31/38] mm: replace memmap_context by meminit_context Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 4.19 32/38] mm: dont rely on system state to detect hot-plug operations Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 4.19 33/38] net/packet: fix overflow in tpacket_rcv Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 4.19 34/38] epoll: do not insert into poll queues until all sanity checks are done Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 4.19 35/38] epoll: replace ->visited/visited_list with generation count Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 4.19 36/38] epoll: EPOLL_CTL_ADD: close the race in decision to take fast path Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 4.19 37/38] ep_create_wakeup_source(): dentry name can change under you Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 4.19 38/38] netfilter: ctnetlink: add a range check for l3/l4 protonum Greg Kroah-Hartman
2020-10-05 20:59 ` Pavel Machek [this message]
2020-10-05 17:50 ` [PATCH 4.19 00/38] 4.19.150-rc1 review Jon Hunter
2020-10-06 0:23 ` Shuah Khan
2020-10-06 8:52 ` Naresh Kamboju
2020-10-06 18:16 ` Guenter Roeck
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20201005205912.GB27782@amd \
--to=pavel@denx.de \
--cc=gregkh@linuxfoundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=pablo@netfilter.org \
--cc=stable@vger.kernel.org \
--cc=willmcvicker@google.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).