This is a note to let you know that I've just added the patch titled
netfilter: nfnetlink: validate nfnetlink header from batch
to the 3.18-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
netfilter-nfnetlink-validate-nfnetlink-header-from-batch.patch
and it can be found in the queue-3.18 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From 9ea2aa8b7dba9e99544c4187cc298face254569f Mon Sep 17 00:00:00 2001
From: Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx>
Date: Sun, 4 Jan 2015 15:20:29 +0100
Subject: netfilter: nfnetlink: validate nfnetlink header from batch
From: Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx>
commit 9ea2aa8b7dba9e99544c4187cc298face254569f upstream.
Make sure there is enough room for the nfnetlink header in the
netlink messages that are part of the batch. There is a similar
check in netlink_rcv_skb().
Signed-off-by: Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
net/netfilter/nfnetlink.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/net/netfilter/nfnetlink.c
+++ b/net/netfilter/nfnetlink.c
@@ -321,7 +321,8 @@ replay:
nlh = nlmsg_hdr(skb);
err = 0;
- if (nlh->nlmsg_len < NLMSG_HDRLEN) {
+ if (nlmsg_len(nlh) < sizeof(struct nfgenmsg) ||
+ skb->len < nlh->nlmsg_len) {
err = -EINVAL;
goto ack;
}
Patches currently in stable-queue which might be from pablo@xxxxxxxxxxxxx are
queue-3.18/netfilter-nfnetlink-validate-nfnetlink-header-from-batch.patch
queue-3.18/netfilter-nf_tables-fix-flush-ruleset-chain-dependencies.patch
queue-3.18/netfilter-nfnetlink-relax-strict-multicast-group-check-from-netlink_bind.patch
queue-3.18/netfilter-conntrack-fix-race-between-confirmation-and-flush.patch
--
To unsubscribe from this list: send the line "unsubscribe stable" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html