On Tue, Mar 22, 2016 at 06:02:53PM +0100, Florian Westphal wrote:
> Ben Hawkes reported an out-of-bounds write in mark_source_chains().
> This was caused by improper underflow check -- we should have bailed
> earlier.
>
> The underflow check has been fixed in the preceeding change
> ("netfilter: x_tables: fix unconditional helper").
>
> Just to be safe also add checks to mark_source_chains() in case we have other
> bugs that would cause such a condition.
>
> Signed-off-by: Florian Westphal <fw@xxxxxxxxx>
> ---
> net/ipv4/netfilter/arp_tables.c | 8 +++++---
> net/ipv4/netfilter/ip_tables.c | 4 ++++
> net/ipv6/netfilter/ip6_tables.c | 4 ++++
> 3 files changed, 13 insertions(+), 3 deletions(-)
>
> diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c
> index a2002ff..13266f4 100644
> --- a/net/ipv4/netfilter/arp_tables.c
> +++ b/net/ipv4/netfilter/arp_tables.c
> @@ -439,6 +439,8 @@ static int mark_source_chains(const struct xt_table_info *newinfo,
> size = e->next_offset;
> e = (struct arpt_entry *)
> (entry0 + pos + size);
> + if (pos + size >= newinfo->size)
> + return 0;
> e->counters.pcnt = pos;
> pos += size;
> } else {
> @@ -461,6 +463,8 @@ static int mark_source_chains(const struct xt_table_info *newinfo,
> } else {
> /* ... this is a fallthru */
> newpos = pos + e->next_offset;
> + if (newpos >= newinfo->size)
> + return 0;
> }
> e = (struct arpt_entry *)
> (entry0 + newpos);
> @@ -682,10 +686,8 @@ static int translate_table(struct xt_table_info *newinfo, void *entry0,
> }
> }
>
> - if (!mark_source_chains(newinfo, repl->valid_hooks, entry0)) {
> - duprintf("Looping hook\n");
> + if (!mark_source_chains(newinfo, repl->valid_hooks, entry0))
> return -ELOOP;
> - }
>
> /* Finally, each sanity check must pass */
> i = 0;
> diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
> index 45b1d97..c4836f0 100644
> --- a/net/ipv4/netfilter/ip_tables.c
> +++ b/net/ipv4/netfilter/ip_tables.c
> @@ -520,6 +520,8 @@ mark_source_chains(const struct xt_table_info *newinfo,
> size = e->next_offset;
> e = (struct ipt_entry *)
> (entry0 + pos + size);
> + if (WARN_ON(pos + size >= newinfo->size))
> + return 0;
This got WARN_ON(), but not in other spots.
I'll place 1 to 4 in the nf tree, then I suggest we take a little bit
more time to follow up to validate that we can actually trigger from
all possible corners.
Thanks Florian!
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
