This is a note to let you know that I've just added the patch titled
netfilter: ctnetlink: don't permit ct creation with random tuple
to the 3.8-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
netfilter-ctnetlink-don-t-permit-ct-creation-with-random-tuple.patch
and it can be found in the queue-3.8 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From 442fad9423b78319e0019a7f5047eddf3317afbc Mon Sep 17 00:00:00 2001
From: Florian Westphal <fw@xxxxxxxxx>
Date: Mon, 11 Feb 2013 23:22:38 +0000
Subject: netfilter: ctnetlink: don't permit ct creation with random tuple
From: Florian Westphal <fw@xxxxxxxxx>
commit 442fad9423b78319e0019a7f5047eddf3317afbc upstream.
Userspace can cause kernel panic by not specifying orig/reply
tuple: kernel will create a tuple with random stack values.
Problem is that tuple.dst.dir will be random, too, which
causes nf_ct_tuplehash_to_ctrack() to return garbage.
Signed-off-by: Florian Westphal <fw@xxxxxxxxx>
Signed-off-by: Pablo Neira Ayuso <pablo@xxxxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
net/netfilter/nf_conntrack_netlink.c | 3 +++
1 file changed, 3 insertions(+)
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -1705,6 +1705,9 @@ ctnetlink_new_conntrack(struct sock *ctn
if (nlh->nlmsg_flags & NLM_F_CREATE) {
enum ip_conntrack_events events;
+ if (!cda[CTA_TUPLE_ORIG] || !cda[CTA_TUPLE_REPLY])
+ return -EINVAL;
+
ct = ctnetlink_create_conntrack(net, zone, cda, &otuple,
&rtuple, u3);
if (IS_ERR(ct))
Patches currently in stable-queue which might be from fw@xxxxxxxxx are
queue-3.8/netfilter-ctnetlink-don-t-permit-ct-creation-with-random-tuple.patch
queue-3.8/netfilter-xt_rpfilter-skip-locally-generated-broadcast-multicast-too.patch
queue-3.8/netfilter-nf_nat-fix-race-when-unloading-protocol-modules.patch
queue-3.8/netfilter-nf_ct_helper-don-t-discard-helper-if-it-is-actually-the-same.patch
--
To unsubscribe from this list: send the line "unsubscribe stable" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html