ACK: [SRU][J/F][PATCH 0/1] CVE-2023-52927

[Massimiliano Pellizzer]

On Fri, 28 Mar 2025 at 18:34, Tim Whisonant <tim.whisonant at canonical.com> wrote:
>
> SRU Justification:
>
> [Impact]
>
> netfilter: allow exp not to be removed in nf_ct_find_expectation
>
> Currently nf_conntrack_in() calling nf_ct_find_expectation() will
> remove the exp from the hash table. However, in some scenario, we
> expect the exp not to be removed when the created ct will not be
> confirmed, like in OVS and TC conntrack in the following patches.
>
> This patch allows exp not to be removed by setting IPS_CONFIRMED
> in the status of the tmpl.
>
> [Fix]
>
> Oracular: not affected
> Noble:    not affected
> Jammy:    backported from upstream
> Focal:    backported from upstream
> Bionic:   patch sent to ESM ML
> Xenial:   work needed - too many prerequisites
> Trusty:   out of scope
>
> [Test Plan]
>
> Compile and boot tested.
>
> [Where problems could occur]
>
> The changes appear in the netfilter connection tracking code,
> specifically in the expectation lookup and removal. Problems
> might involve failure to release expectations at the appropriate
> time.
>
> Xin Long (1):
>   netfilter: allow exp not to be removed in nf_ct_find_expectation
>
>  include/net/netfilter/nf_conntrack_expect.h | 2 +-
>  net/netfilter/nf_conntrack_core.c           | 2 +-
>  net/netfilter/nf_conntrack_expect.c         | 4 ++--
>  net/netfilter/nft_ct.c                      | 2 ++
>  4 files changed, 6 insertions(+), 4 deletions(-)
>
> --
> 2.43.0
>
>
> --
> kernel-team mailing list
> kernel-team at lists.ubuntu.com
> https://lists.ubuntu.com/mailman/listinfo/kernel-team

Acked-by: Massimiliano Pellizzer <massimiliano.pellizzer at canonical.com>

-- 
Massimiliano Pellizzer