From 8b122b111a94cc23221d89e7dd412171244c5710 Mon Sep 17 00:00:00 2001 From: Greg Rose Date: Mon, 4 Nov 2024 11:15:17 -0800 Subject: [PATCH 1/2] netfilter: nf_tables: bail out on mismatching dynset and set expressions jira VULN-683 cve CVE-2023-6622 commit-author Pablo Neira Ayuso commit 3701cd390fd731ee7ae8b8006246c8db82c72bea If dynset expressions provided by userspace is larger than the declared set expressions, then bail out. Fixes: 48b0ae046ee9 ("netfilter: nftables: netlink support for several set element expressions") Reported-by: Xingyuan Mo Signed-off-by: Pablo Neira Ayuso (cherry picked from commit 3701cd390fd731ee7ae8b8006246c8db82c72bea) Signed-off-by: Greg Rose --- net/netfilter/nft_dynset.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/net/netfilter/nft_dynset.c b/net/netfilter/nft_dynset.c index f407b3e9c178d..ae61505d4c41e 100644 --- a/net/netfilter/nft_dynset.c +++ b/net/netfilter/nft_dynset.c @@ -274,10 +274,15 @@ static int nft_dynset_init(const struct nft_ctx *ctx, priv->expr_array[i] = dynset_expr; priv->num_exprs++; - if (set->num_exprs && - dynset_expr->ops != set->exprs[i]->ops) { - err = -EOPNOTSUPP; - goto err_expr_free; + if (set->num_exprs) { + if (i >= set->num_exprs) { + err = -EINVAL; + goto err_expr_free; + } + if (dynset_expr->ops != set->exprs[i]->ops) { + err = -EOPNOTSUPP; + goto err_expr_free; + } } i++; } From adc34783998cda639b68250560e3956d0a118bde Mon Sep 17 00:00:00 2001 From: Greg Rose Date: Mon, 4 Nov 2024 11:39:41 -0800 Subject: [PATCH 2/2] netfilter: nf_tables: disallow anonymous set with timeout flag jira VULN-827 cve CVE-2024-26642 commit-author Pablo Neira Ayuso commit 16603605b667b70da974bea8216c93e7db043bf1 Anonymous sets are never used with timeout from userspace, reject this. Exception to this rule is NFT_SET_EVAL to ensure legacy meters still work. Cc: stable@vger.kernel.org Fixes: 761da2935d6e ("netfilter: nf_tables: add set timeout API support") Reported-by: lonial con Signed-off-by: Pablo Neira Ayuso (cherry picked from commit 16603605b667b70da974bea8216c93e7db043bf1) Signed-off-by: Greg Rose --- net/netfilter/nf_tables_api.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index d9346fab34f9e..3a49209969c72 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -4152,6 +4152,9 @@ static int nf_tables_newset(struct net *net, struct sock *nlsk, if ((flags & (NFT_SET_EVAL | NFT_SET_OBJECT)) == (NFT_SET_EVAL | NFT_SET_OBJECT)) return -EOPNOTSUPP; + if ((flags & (NFT_SET_ANONYMOUS | NFT_SET_TIMEOUT | NFT_SET_EVAL)) == + (NFT_SET_ANONYMOUS | NFT_SET_TIMEOUT)) + return -EOPNOTSUPP; } dtype = 0;