This is a note to let you know that I've just added the patch titled
netfilter: nf_tables: do not allow SET_ID to refer to another table
to the 4.14-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
netfilter-nf_tables-do-not-allow-set_id-to-refer-to-another-table.patch
and it can be found in the queue-4.14 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From stable-owner@xxxxxxxxxxxxxxx Sat May 27 16:08:15 2023
From: Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx>
Date: Sat, 27 May 2023 18:08:10 +0200
Subject: netfilter: nf_tables: do not allow SET_ID to refer to another table
To: netfilter-devel@xxxxxxxxxxxxxxx
Cc: gregkh@xxxxxxxxxxxxxxxxxxx, stable@xxxxxxxxxxxxxxx, sashal@xxxxxxxxxx
Message-ID: <20230527160811.67779-11-pablo@xxxxxxxxxxxxx>
From: Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx>
[ 470ee20e069a6d05ae549f7d0ef2bdbcee6a81b2 ]
When doing lookups for sets on the same batch by using its ID, a set from a
different table can be used.
Then, when the table is removed, a reference to the set may be kept after
the set is freed, leading to a potential use-after-free.
When looking for sets by ID, use the table that was used for the lookup by
name, and only return sets belonging to that same table.
This fixes CVE-2022-2586, also reported as ZDI-CAN-17470.
Reported-by: Team Orca of Sea Security (@seasecresponse)
Fixes: 958bee14d071 ("netfilter: nf_tables: use new transaction infrastructure to handle sets")
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@xxxxxxxxxxxxx>
Cc: <stable@xxxxxxxxxxxxxxx>
Signed-off-by: Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
include/net/netfilter/nf_tables.h | 2 ++
net/netfilter/nf_tables_api.c | 7 +++++--
2 files changed, 7 insertions(+), 2 deletions(-)
--- a/include/net/netfilter/nf_tables.h
+++ b/include/net/netfilter/nf_tables.h
@@ -381,6 +381,7 @@ void nft_unregister_set(struct nft_set_t
*
* @list: table set list node
* @bindings: list of set bindings
+ * @table: table this set belongs to
* @name: name of the set
* @ktype: key type (numeric type defined by userspace, not used in the kernel)
* @dtype: data type (verdict or numeric type defined by userspace)
@@ -404,6 +405,7 @@ void nft_unregister_set(struct nft_set_t
struct nft_set {
struct list_head list;
struct list_head bindings;
+ struct nft_table *table;
char *name;
u32 ktype;
u32 dtype;
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -2746,6 +2746,7 @@ static struct nft_set *nf_tables_set_loo
}
static struct nft_set *nf_tables_set_lookup_byid(const struct net *net,
+ const struct nft_table *table,
const struct nlattr *nla,
u8 genmask)
{
@@ -2757,6 +2758,7 @@ static struct nft_set *nf_tables_set_loo
struct nft_set *set = nft_trans_set(trans);
if (id == nft_trans_set_id(trans) &&
+ set->table == table &&
nft_active_genmask(set, genmask))
return set;
}
@@ -2777,7 +2779,7 @@ struct nft_set *nft_set_lookup(const str
if (!nla_set_id)
return set;
- set = nf_tables_set_lookup_byid(net, nla_set_id, genmask);
+ set = nf_tables_set_lookup_byid(net, table, nla_set_id, genmask);
}
return set;
}
@@ -3272,6 +3274,7 @@ static int nf_tables_newset(struct net *
}
INIT_LIST_HEAD(&set->bindings);
+ set->table = table;
set->ops = ops;
set->ktype = ktype;
set->klen = desc.klen;
@@ -4209,7 +4212,7 @@ static int nf_tables_newsetelem(struct n
genmask);
if (IS_ERR(set)) {
if (nla[NFTA_SET_ELEM_LIST_SET_ID]) {
- set = nf_tables_set_lookup_byid(net,
+ set = nf_tables_set_lookup_byid(net, ctx.table,
nla[NFTA_SET_ELEM_LIST_SET_ID],
genmask);
}
Patches currently in stable-queue which might be from stable-owner@xxxxxxxxxxxxxxx are
queue-4.14/netfilter-nftables-add-nft_parse_register_load-and-use-it.patch
queue-4.14/netfilter-nftables-add-nft_parse_register_store-and-use-it.patch
queue-4.14/netfilter-nf_tables-fix-register-ordering.patch
queue-4.14/netfilter-nftables-statify-nft_parse_register.patch
queue-4.14/netfilter-nf_tables-validate-registers-coming-from-userspace.patch
queue-4.14/netfilter-nft_dynset-do-not-reject-set-updates-with-nft_set_eval.patch
queue-4.14/netfilter-nf_tables-do-not-allow-set_id-to-refer-to-another-table.patch
queue-4.14/netfilter-nf_tables-stricter-validation-of-element-data.patch
queue-4.14/netfilter-nf_tables-add-nft_setelem_parse_key.patch
queue-4.14/netfilter-nf_tables-do-not-allow-rule_id-to-refer-to-another-chain.patch
queue-4.14/netfilter-nf_tables-allow-up-to-64-bytes-in-the-set-element-data-area.patch
