Hi David,
The following patchset contains two bugfixes for your net tree, they are:
1) Validate netlink group from nfnetlink to avoid an out of bound array
access. This should only happen with superuser priviledges though.
Discovered by Andrey Ryabinin using trinity.
2) Don't push ethernet header before calling the netfilter output hook
for multicast traffic, this breaks ebtables since it expects to see
skb->data pointing to the network header, patch from Linus Luessing.
You can pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git
Thanks!
----------------------------------------------------------------
The following changes since commit feb91a02ccb09661507f170b2a444aec94f307f9:
ipv6: mld: fix add_grhead skb_over_panic for devs with large MTUs (2014-11-16 16:55:06 -0500)
are available in the git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git master
for you to fetch changes up to f0b4eeced518c632210ef2aea44fc92cc9e86cce:
bridge: fix netfilter/NF_BR_LOCAL_OUT for own, locally generated queries (2014-11-17 12:38:02 +0100)
----------------------------------------------------------------
Linus Lüssing (1):
bridge: fix netfilter/NF_BR_LOCAL_OUT for own, locally generated queries
Pablo Neira Ayuso (1):
netfilter: nfnetlink: fix insufficient validation in nfnetlink_bind
net/bridge/br_multicast.c | 3 +--
net/netfilter/nfnetlink.c | 12 +++++++++++-
2 files changed, 12 insertions(+), 3 deletions(-)
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
