* [PATCH nf] netfilter/xt_sctp: validate the flag_info count
@ 2023-08-28 22:12 Wander Lairson Costa
2023-08-30 15:17 ` Pablo Neira Ayuso
0 siblings, 1 reply; 2+ messages in thread
From: Wander Lairson Costa @ 2023-08-28 22:12 UTC (permalink / raw)
To: Pablo Neira Ayuso, Jozsef Kadlecsik, Florian Westphal,
David S. Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni,
Harald Welte, open list:NETFILTER, open list:NETFILTER,
open list:NETWORKING [GENERAL],
open list
Cc: Wander Lairson Costa, Lucas Leong, stable
sctp_mt_check doesn't validate the flag_count field. An attacker can
take advantage of that to trigger a OOB read and leak memory
information.
Add the field validation in the checkentry function.
Fixes: 2e4e6a17af35 ("[NETFILTER] x_tables: Abstraction layer for {ip,ip6,arp}_tables")
Reported-by: Lucas Leong <wmliang@infosec.exchange>
Cc: stable@kernel.org
Signed-off-by: Wander Lairson Costa <wander@redhat.com>
---
net/netfilter/xt_sctp.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/net/netfilter/xt_sctp.c b/net/netfilter/xt_sctp.c
index e8961094a282..b46a6a512058 100644
--- a/net/netfilter/xt_sctp.c
+++ b/net/netfilter/xt_sctp.c
@@ -149,6 +149,8 @@ static int sctp_mt_check(const struct xt_mtchk_param *par)
{
const struct xt_sctp_info *info = par->matchinfo;
+ if (info->flag_count > ARRAY_SIZE(info->flag_info))
+ return -EINVAL;
if (info->flags & ~XT_SCTP_VALID_FLAGS)
return -EINVAL;
if (info->invflags & ~XT_SCTP_VALID_FLAGS)
--
2.41.0
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH nf] netfilter/xt_sctp: validate the flag_info count
2023-08-28 22:12 [PATCH nf] netfilter/xt_sctp: validate the flag_info count Wander Lairson Costa
@ 2023-08-30 15:17 ` Pablo Neira Ayuso
0 siblings, 0 replies; 2+ messages in thread
From: Pablo Neira Ayuso @ 2023-08-30 15:17 UTC (permalink / raw)
To: Wander Lairson Costa
Cc: Jozsef Kadlecsik, Florian Westphal, David S. Miller,
Eric Dumazet, Jakub Kicinski, Paolo Abeni, Harald Welte,
open list:NETFILTER, open list:NETFILTER,
open list:NETWORKING [GENERAL],
open list, Lucas Leong, stable
On Mon, Aug 28, 2023 at 07:12:55PM -0300, Wander Lairson Costa wrote:
> sctp_mt_check doesn't validate the flag_count field. An attacker can
> take advantage of that to trigger a OOB read and leak memory
> information.
>
> Add the field validation in the checkentry function.
Applied to nf, thanks
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2023-08-30 15:17 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2023-08-28 22:12 [PATCH nf] netfilter/xt_sctp: validate the flag_info count Wander Lairson Costa
2023-08-30 15:17 ` Pablo Neira Ayuso
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).