mirror of
https://github.com/brain-hackers/linux-brain.git
synced 2024-06-09 07:16:21 +09:00
netfilter: x_tables: fix compat match/target pad out-of-bound write
commit b29c457a6511435960115c0f548c4360d5f4801d upstream.
xt_compat_match/target_from_user doesn't check that zeroing the area
to start of next rule won't write past end of allocated ruleset blob.
Remove this code and zero the entire blob beforehand.
Reported-by: syzbot+cfc0247ac173f597aaaa@syzkaller.appspotmail.com
Reported-by: Andy Nguyen <theflow@google.com>
Fixes: 9fa492cdc1
("[NETFILTER]: x_tables: simplify compat API")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
8119a2b420
commit
cc59b872f2
|
@ -1196,6 +1196,8 @@ static int translate_compat_table(struct net *net,
|
||||||
if (!newinfo)
|
if (!newinfo)
|
||||||
goto out_unlock;
|
goto out_unlock;
|
||||||
|
|
||||||
|
memset(newinfo->entries, 0, size);
|
||||||
|
|
||||||
newinfo->number = compatr->num_entries;
|
newinfo->number = compatr->num_entries;
|
||||||
for (i = 0; i < NF_ARP_NUMHOOKS; i++) {
|
for (i = 0; i < NF_ARP_NUMHOOKS; i++) {
|
||||||
newinfo->hook_entry[i] = compatr->hook_entry[i];
|
newinfo->hook_entry[i] = compatr->hook_entry[i];
|
||||||
|
|
|
@ -1430,6 +1430,8 @@ translate_compat_table(struct net *net,
|
||||||
if (!newinfo)
|
if (!newinfo)
|
||||||
goto out_unlock;
|
goto out_unlock;
|
||||||
|
|
||||||
|
memset(newinfo->entries, 0, size);
|
||||||
|
|
||||||
newinfo->number = compatr->num_entries;
|
newinfo->number = compatr->num_entries;
|
||||||
for (i = 0; i < NF_INET_NUMHOOKS; i++) {
|
for (i = 0; i < NF_INET_NUMHOOKS; i++) {
|
||||||
newinfo->hook_entry[i] = compatr->hook_entry[i];
|
newinfo->hook_entry[i] = compatr->hook_entry[i];
|
||||||
|
|
|
@ -1445,6 +1445,8 @@ translate_compat_table(struct net *net,
|
||||||
if (!newinfo)
|
if (!newinfo)
|
||||||
goto out_unlock;
|
goto out_unlock;
|
||||||
|
|
||||||
|
memset(newinfo->entries, 0, size);
|
||||||
|
|
||||||
newinfo->number = compatr->num_entries;
|
newinfo->number = compatr->num_entries;
|
||||||
for (i = 0; i < NF_INET_NUMHOOKS; i++) {
|
for (i = 0; i < NF_INET_NUMHOOKS; i++) {
|
||||||
newinfo->hook_entry[i] = compatr->hook_entry[i];
|
newinfo->hook_entry[i] = compatr->hook_entry[i];
|
||||||
|
|
|
@ -733,7 +733,7 @@ void xt_compat_match_from_user(struct xt_entry_match *m, void **dstptr,
|
||||||
{
|
{
|
||||||
const struct xt_match *match = m->u.kernel.match;
|
const struct xt_match *match = m->u.kernel.match;
|
||||||
struct compat_xt_entry_match *cm = (struct compat_xt_entry_match *)m;
|
struct compat_xt_entry_match *cm = (struct compat_xt_entry_match *)m;
|
||||||
int pad, off = xt_compat_match_offset(match);
|
int off = xt_compat_match_offset(match);
|
||||||
u_int16_t msize = cm->u.user.match_size;
|
u_int16_t msize = cm->u.user.match_size;
|
||||||
char name[sizeof(m->u.user.name)];
|
char name[sizeof(m->u.user.name)];
|
||||||
|
|
||||||
|
@ -743,9 +743,6 @@ void xt_compat_match_from_user(struct xt_entry_match *m, void **dstptr,
|
||||||
match->compat_from_user(m->data, cm->data);
|
match->compat_from_user(m->data, cm->data);
|
||||||
else
|
else
|
||||||
memcpy(m->data, cm->data, msize - sizeof(*cm));
|
memcpy(m->data, cm->data, msize - sizeof(*cm));
|
||||||
pad = XT_ALIGN(match->matchsize) - match->matchsize;
|
|
||||||
if (pad > 0)
|
|
||||||
memset(m->data + match->matchsize, 0, pad);
|
|
||||||
|
|
||||||
msize += off;
|
msize += off;
|
||||||
m->u.user.match_size = msize;
|
m->u.user.match_size = msize;
|
||||||
|
@ -1116,7 +1113,7 @@ void xt_compat_target_from_user(struct xt_entry_target *t, void **dstptr,
|
||||||
{
|
{
|
||||||
const struct xt_target *target = t->u.kernel.target;
|
const struct xt_target *target = t->u.kernel.target;
|
||||||
struct compat_xt_entry_target *ct = (struct compat_xt_entry_target *)t;
|
struct compat_xt_entry_target *ct = (struct compat_xt_entry_target *)t;
|
||||||
int pad, off = xt_compat_target_offset(target);
|
int off = xt_compat_target_offset(target);
|
||||||
u_int16_t tsize = ct->u.user.target_size;
|
u_int16_t tsize = ct->u.user.target_size;
|
||||||
char name[sizeof(t->u.user.name)];
|
char name[sizeof(t->u.user.name)];
|
||||||
|
|
||||||
|
@ -1126,9 +1123,6 @@ void xt_compat_target_from_user(struct xt_entry_target *t, void **dstptr,
|
||||||
target->compat_from_user(t->data, ct->data);
|
target->compat_from_user(t->data, ct->data);
|
||||||
else
|
else
|
||||||
memcpy(t->data, ct->data, tsize - sizeof(*ct));
|
memcpy(t->data, ct->data, tsize - sizeof(*ct));
|
||||||
pad = XT_ALIGN(target->targetsize) - target->targetsize;
|
|
||||||
if (pad > 0)
|
|
||||||
memset(t->data + target->targetsize, 0, pad);
|
|
||||||
|
|
||||||
tsize += off;
|
tsize += off;
|
||||||
t->u.user.target_size = tsize;
|
t->u.user.target_size = tsize;
|
||||||
|
|
Loading…
Reference in New Issue
Block a user