APPLIED: [SRU][J/F][PATCH v4 0/1] CVE-2024-27012

[Stefan Bader]

On 09.08.24 14:25, Hannah Peuckmann wrote:
> [Impact]
> The existing code in nf_tables has an issue where set elements are not properly restored when the delete set operation fails.
> 
> [Fix]
> This patch ensures that all set elements are correctly handled during the delete operation, maintaining the integrity of the nf_tables.
> 
> Noble: done
> Jammy: applied, fixed context conflicts
> Focal: applied, fixed context conflicts
> Bionic: not affected
> Xenial: not affected
> Trusty: not affected
> 
> Focal and Jammy are missing the following commit:
> 0e1ea651c9717dd ("netfilter: nf_tables: shrink memory consumption of set elements")
> 
> This introduced context conflicts in nf_tables_api.c and for jammy also in nft_set_pipapo.c, but
> they aren't related to the fix and are relatively straightforward to resolve.
> 
> [v4 changes]
> 
> I adjusted the context in nft_map_catchall_deactivate again to handle elem.priv correctly.
> elem.priv is now being set first and passed to nft_setelem_data_deactivate afterwards.
> 
> 
> [Test Case]
> 
> Compiled and booted.
> 
> [Where problems could occur]
> 
> This fix affects those who use the nf_tables in netfilter. An issue with this fix could result in unexpected behaviour
> or inconsistencies in the netfilter tables.
> 
> 
> Pablo Neira Ayuso (1):
>    netfilter: nf_tables: restore set elements when delete set fails
> 
>   net/netfilter/nf_tables_api.c  | 25 +++++++++++++++++++++++++
>   net/netfilter/nft_set_bitmap.c |  4 +---
>   net/netfilter/nft_set_hash.c   |  8 ++------
>   net/netfilter/nft_set_rbtree.c |  4 +---
>   4 files changed, 29 insertions(+), 12 deletions(-)
> 

Applied to jammy,focal:linux/master-next. Thanks.

-Stefan

-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_0xE8675DEECBEECEA3.asc
Type: application/pgp-keys
Size: 48643 bytes
Desc: OpenPGP public key
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20240816/5b3256f5/attachment-0001.key>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20240816/5b3256f5/attachment-0001.sig>