APPLIED: [SRU][OEM-5.17][PATCH 1/1] netfilter: nf_tables: stricter validation of element data

[Dimitri John Ledkov]

Applied to hwe-5.17-next

On Wed, 6 Jul 2022 at 16:26, Cengiz Can <cengiz.can at canonical.com> wrote:
>
> From: Pablo Neira Ayuso <pablo at netfilter.org>
>
> Make sure element data type and length do not mismatch the one specified
> by the set declaration.
>
> Fixes: 7d7402642eaf ("netfilter: nf_tables: variable sized set element keys / data")
> Reported-by: Hugues ANGUELKOV <hanguelkov at randorisec.fr>
> Signed-off-by: Pablo Neira Ayuso <pablo at netfilter.org>
> CVE-2022-34918
> (cherry picked from commit 7e6bc1f6cabcd30aba0b11219d8e01b952eacbb6 net.git)
> Signed-off-by: Cengiz Can <cengiz.can at canonical.com>
> ---
>  net/netfilter/nf_tables_api.c | 9 ++++++++-
>  1 file changed, 8 insertions(+), 1 deletion(-)
>
> diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
> index d71a33ae39b35..e82d6d4856845 100644
> --- a/net/netfilter/nf_tables_api.c
> +++ b/net/netfilter/nf_tables_api.c
> @@ -5106,13 +5106,20 @@ static int nft_setelem_parse_data(struct nft_ctx *ctx, struct nft_set *set,
>                                   struct nft_data *data,
>                                   struct nlattr *attr)
>  {
> +       u32 dtype;
>         int err;
>
>         err = nft_data_init(ctx, data, NFT_DATA_VALUE_MAXLEN, desc, attr);
>         if (err < 0)
>                 return err;
>
> -       if (desc->type != NFT_DATA_VERDICT && desc->len != set->dlen) {
> +       if (set->dtype == NFT_DATA_VERDICT)
> +               dtype = NFT_DATA_VERDICT;
> +       else
> +               dtype = NFT_DATA_VALUE;
> +
> +       if (dtype != desc->type ||
> +           set->dlen != desc->len) {
>                 nft_data_release(data, desc->type);
>                 return -EINVAL;
>         }
> --
> 2.34.1
>
>
> --
> kernel-team mailing list
> kernel-team at lists.ubuntu.com
> https://lists.ubuntu.com/mailman/listinfo/kernel-team



-- 
okurrr,

Dimitri