system/linux
system/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux synced 2024-07-21 10:41:44 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
linux/net
History
Wander Lairson Costa f4f8a78031 netfilter: nfnetlink_osf: avoid OOB read 
The opt_num field is controlled by user mode and is not currently
validated inside the kernel. An attacker can take advantage of this to
trigger an OOB read and potentially leak information.

BUG: KASAN: slab-out-of-bounds in nf_osf_match_one+0xbed/0xd10 net/netfilter/nfnetlink_osf.c:88
Read of size 2 at addr ffff88804bc64272 by task poc/6431

CPU: 1 PID: 6431 Comm: poc Not tainted 6.0.0-rc4 #1
Call Trace:
 nf_osf_match_one+0xbed/0xd10 net/netfilter/nfnetlink_osf.c:88
 nf_osf_find+0x186/0x2f0 net/netfilter/nfnetlink_osf.c:281
 nft_osf_eval+0x37f/0x590 net/netfilter/nft_osf.c:47
 expr_call_ops_eval net/netfilter/nf_tables_core.c:214
 nft_do_chain+0x2b0/0x1490 net/netfilter/nf_tables_core.c:264
 nft_do_chain_ipv4+0x17c/0x1f0 net/netfilter/nft_chain_filter.c:23
 [..]

Also add validation to genre, subtype and version fields.

Fixes: 11eeef41d5 ("netfilter: passive OS fingerprint xtables match")
Reported-by: Lucas Leong <wmliang@infosec.exchange>
Signed-off-by: Wander Lairson Costa <wander@redhat.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
2023-09-06 18:07:49 +02:00
..
6lowpan
9p net: annotate data-races around sock->ops 2023-08-09 15:32:43 -07:00
802
8021q Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2023-08-18 12:44:56 -07:00
appletalk sock: Remove ->sendpage*() in favour of sendmsg(MSG_SPLICE_PAGES) 2023-06-24 15:50:13 -07:00
atm sock: Remove ->sendpage*() in favour of sendmsg(MSG_SPLICE_PAGES) 2023-06-24 15:50:13 -07:00
ax25 sock: Remove ->sendpage*() in favour of sendmsg(MSG_SPLICE_PAGES) 2023-06-24 15:50:13 -07:00
batman-adv Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2023-08-24 10:51:39 -07:00
bluetooth Bluetooth: HCI: Introduce HCI_QUIRK_BROKEN_LE_CODED 2023-08-24 12:23:46 -07:00
bpf bpf: Prevent inlining of bpf_fentry_test7() 2023-08-30 08:36:17 +02:00
bpfilter net: Use umd_cleanup_helper() 2023-05-31 13:06:57 +02:00
bridge netfilter: ebtables: fix fortify warnings in size_entry_mwt() 2023-08-22 15:13:20 +02:00
caif sock: Remove ->sendpage*() in favour of sendmsg(MSG_SPLICE_PAGES) 2023-06-24 15:50:13 -07:00
can net: annotate data-races around sk->sk_tsflags 2023-09-01 07:27:33 +01:00
ceph libceph: fix potential hang in ceph_osdc_notify() 2023-08-02 09:07:34 +02:00
core net/ipv6: SKB symmetric hash should incorporate transport ports 2023-09-06 06:02:27 +01:00
dcb net: dcb: choose correct policy to parse DCB_ATTR_BCN 2023-08-01 21:07:46 -07:00
dccp Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2023-08-29 07:44:56 +02:00
devlink devlink: move devlink_notify_register/unregister() to dev.c 2023-08-28 08:02:24 -07:00
dns_resolver
dsa net: dsa: mark parsed interface mode for legacy switch drivers 2023-08-09 13:08:09 -07:00
ethernet
ethtool ethtool: netlink: always pass genl_info to .prepare_data 2023-08-15 15:01:03 -07:00
handshake net/handshake: fix null-ptr-deref in handshake_nl_done_doit() 2023-09-01 07:25:14 +01:00
hsr net/hsr: Remove unused function declarations 2023-07-31 20:11:47 -07:00
ieee802154 genetlink: use attrs from struct genl_info 2023-08-15 15:00:45 -07:00
ife
ipv4 igmp: limit igmpv3_newpack() packet size to IP_MAX_MTU 2023-09-05 17:49:40 +01:00
ipv6 net: ipv6/addrconf: avoid integer underflow in ipv6_create_tempaddr 2023-09-04 07:07:30 +01:00
iucv
kcm kcm: Destroy mutex in kcm_exit_net() 2023-09-05 10:12:03 +02:00
key Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2023-08-18 12:44:56 -07:00
l2tp inet: introduce inet->inet_flags 2023-08-16 11:09:16 +01:00
l3mdev
lapb
llc net/llc/llc_conn.c: fix 4 instances of -Wmissing-variable-declarations 2023-08-09 15:34:28 -07:00
mac80211 wireless-next patches for v6.6 2023-08-25 18:35:09 -07:00
mac802154 Core WPAN changes: 2023-06-24 15:41:46 -07:00
mctp sock: Remove ->sendpage*() in favour of sendmsg(MSG_SPLICE_PAGES) 2023-06-24 15:50:13 -07:00
mpls net: move gso declarations and functions to their own files 2023-06-10 00:11:41 -07:00
mptcp mptcp: annotate data-races around msk->rmem_fwd_alloc 2023-09-01 07:27:33 +01:00
ncsi genetlink: make genl_info->nlhdr const 2023-08-15 14:54:44 -07:00
netfilter netfilter: nfnetlink_osf: avoid OOB read 2023-09-06 18:07:49 +02:00
netlabel netlabel: Remove unused declaration netlbl_cipsov4_doi_free() 2023-08-02 12:28:22 -07:00
netlink genetlink: add a family pointer to struct genl_info 2023-08-15 15:01:03 -07:00
netrom netrom: Deny concurrent connect(). 2023-08-28 06:58:46 +01:00
nfc genetlink: use attrs from struct genl_info 2023-08-15 15:00:45 -07:00
nsh net: move gso declarations and functions to their own files 2023-06-10 00:11:41 -07:00
openvswitch Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2023-08-18 12:44:56 -07:00
packet Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2023-08-10 14:10:53 -07:00
phonet sock: Remove ->sendpage*() in favour of sendmsg(MSG_SPLICE_PAGES) 2023-06-24 15:50:13 -07:00
psample
qrtr net: qrtr: Handle IPCR control port format of older targets 2023-07-17 09:02:30 +01:00
rds net/rds: Remove unused function declarations 2023-08-13 12:25:42 +01:00
rfkill
rose sock: Remove ->sendpage*() in favour of sendmsg(MSG_SPLICE_PAGES) 2023-06-24 15:50:13 -07:00
rxrpc Networking changes for 6.5. 2023-06-28 16:43:10 -07:00
sched net: sched: sch_qfq: Fix UAF in qfq_dequeue() 2023-09-05 08:54:12 +02:00
sctp sctp: annotate data-races around sk->sk_wmem_queued 2023-08-31 11:56:59 +02:00
smc net: annotate data-races around sk->sk_lingertime 2023-08-21 07:41:57 +01:00
strparser
sunrpc Networking changes for 6.6. 2023-08-29 11:33:01 -07:00
switchdev net: switchdev: Add a helper to replay objects on a bridge port 2023-07-21 08:54:03 +01:00
tipc genetlink: use attrs from struct genl_info 2023-08-15 15:00:45 -07:00
tls tls: get cipher_name from cipher_desc in tls_set_sw_offload 2023-08-27 17:17:42 -07:00
unix af_unix: Fix data-race around unix_tot_inflight. 2023-09-04 11:06:16 +01:00
vmw_vsock vsock: Remove unused function declarations 2023-07-31 14:41:08 -07:00
wireless wifi: nl80211: Remove unused declaration nl80211_pmsr_dump_results() 2023-08-22 21:40:40 +02:00
x25 sock: Remove ->sendpage*() in favour of sendmsg(MSG_SPLICE_PAGES) 2023-06-24 15:50:13 -07:00
xdp xsk: Fix xsk_diag use-after-free error during socket cleanup 2023-08-31 13:21:11 +02:00
xfrm Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2023-08-18 12:44:56 -07:00
compat.c
devres.c
Kconfig bpf: Add fd-based tcx multi-prog infra with link support 2023-07-19 10:07:27 -07:00
Kconfig.debug
Makefile
socket.c net: annotate data-races around sk->sk_bind_phc 2023-09-01 07:27:33 +01:00
sysctl_net.c