Wander Lairson Costa 19280e8dfb netfilter: nfnetlink_osf: avoid OOB read ... [ Upstream commit f4f8a78031 ] The opt_num field is controlled by user mode and is not currently validated inside the kernel. An attacker can take advantage of this to trigger an OOB read and potentially leak information. BUG: KASAN: slab-out-of-bounds in nf_osf_match_one+0xbed/0xd10 net/netfilter/nfnetlink_osf.c:88 Read of size 2 at addr ffff88804bc64272 by task poc/6431 CPU: 1 PID: 6431 Comm: poc Not tainted 6.0.0-rc4 #1 Call Trace: nf_osf_match_one+0xbed/0xd10 net/netfilter/nfnetlink_osf.c:88 nf_osf_find+0x186/0x2f0 net/netfilter/nfnetlink_osf.c:281 nft_osf_eval+0x37f/0x590 net/netfilter/nft_osf.c:47 expr_call_ops_eval net/netfilter/nf_tables_core.c:214 nft_do_chain+0x2b0/0x1490 net/netfilter/nf_tables_core.c:264 nft_do_chain_ipv4+0x17c/0x1f0 net/netfilter/nft_chain_filter.c:23 [..] Also add validation to genre, subtype and version fields. Fixes: 11eeef41d5 ("netfilter: passive OS fingerprint xtables match") Reported-by: Lucas Leong <wmliang@infosec.exchange> Signed-off-by: Wander Lairson Costa <wander@redhat.com> Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Sasha Levin <sashal@kernel.org>		2023-09-19 12:23:00 +02:00
..
6lowpan	6lowpan: iphc: Fix an off-by-one check of array index	2021-07-22 16:19:03 +02:00
9p	9p: virtio: make sure 'offs' is initialized in zc_request	2023-09-19 12:22:27 +02:00
802	mrp: introduce active flags to prevent UAF when applicant uninit	2022-12-31 13:14:42 +01:00
8021q	vlan: fix a potential uninit-value in vlan_dev_hard_start_xmit()	2023-05-24 17:36:52 +01:00
appletalk	net: socket: rework compat_ifreq_ioctl()	2021-07-23 14:20:25 +01:00
atm	atm: hide unused procfs functions	2023-06-09 10:32:26 +02:00
ax25	net: ax25: Fix deadlock caused by skb_recv_datagram in ax25_recvmsg	2022-06-22 14:22:01 +02:00
batman-adv	batman-adv: Hold rtnl lock during MTU update via netlink	2023-08-30 16:18:18 +02:00
bluetooth	Bluetooth: Fix potential use-after-free when clear keys	2023-09-19 12:22:33 +02:00
bpf	bpf: Move skb->len == 0 checks into __bpf_redirect	2022-12-31 13:14:11 +01:00
bpfilter	bpfilter: Specify the log level for the kmsg message	2021-06-25 13:13:50 +02:00
bridge	bridge: Add extack warning when enabling STP in netns.	2023-07-27 08:46:59 +02:00
caif	net: caif: Fix use-after-free in cfusbl_device_notify()	2023-03-17 08:48:54 +01:00
can	can: raw: add missing refcount for memory leak fix	2023-08-30 16:18:20 +02:00
ceph	libceph: fix potential hang in ceph_osdc_notify()	2023-08-11 15:13:55 +02:00
core	af_unix: Fix data race around sk->sk_err.	2023-09-19 12:22:59 +02:00
dcb	net: dcb: choose correct policy to parse DCB_ATTR_BCN	2023-08-11 15:13:53 +02:00
dccp	dccp: Fix out of bounds access in DCCP error handler	2023-09-19 12:22:52 +02:00
dns_resolver	…
dsa	net: dsa: tag_sja1105: fix MAC DA patching from meta frames	2023-07-23 13:47:30 +02:00
ethernet	move netdev_boot_setup into Space.c	2021-08-03 13:05:26 +01:00
ethtool	ethtool: Fix uninitialized number of lanes	2023-05-17 11:50:18 +02:00
hsr	hsr: ratelimit only when errors are printed	2023-04-05 11:25:02 +02:00
ieee802154	net: ieee802154: fix error return code in dgram_bind()	2022-11-03 23:59:14 +09:00
ife	…
ipv4	ipv4: ignore dst hint for multipath routes	2023-09-19 12:22:58 +02:00
ipv6	net: ipv6/addrconf: avoid integer underflow in ipv6_create_tempaddr	2023-09-19 12:22:58 +02:00
iucv	net/iucv: Fix size of interrupt data	2023-03-22 13:31:28 +01:00
kcm	kcm: Destroy mutex in kcm_exit_net()	2023-09-19 12:22:59 +02:00
key	net: af_key: fix sadb_x_filter validation	2023-08-26 14:23:32 +02:00
l2tp	inet6: Remove inet6_destroy_sock() in sk->sk_prot->destroy().	2023-04-26 13:51:54 +02:00
l3mdev	l3mdev: l3mdev_master_upper_ifindex_by_index_rcu should be using netdev_master_upper_dev_get_rcu	2022-04-27 14:38:53 +02:00
lapb	net: lapb: Use list_for_each_entry() to simplify code in lapb_iface.c	2021-06-08 16:31:25 -07:00
llc	llc: Don't drop packet from non-root netns.	2023-07-27 08:47:02 +02:00
mac80211	wifi: mac80211: simplify chanctx allocation	2023-06-09 10:32:25 +02:00
mac802154	mac802154: fix missing INIT_LIST_HEAD in ieee802154_if_add()	2022-12-14 11:37:25 +01:00
mctp	net: mctp: purge receive queues on sk destruction	2023-02-06 07:59:02 +01:00
mpls	net: mpls: fix stale pointer if allocation fails during device rename	2023-02-22 12:57:09 +01:00
mptcp	mptcp: consolidate fallback and non fallback state machine	2023-07-05 18:25:04 +01:00
ncsi	net/ncsi: change from ndo_set_mac_address to dev_set_mac_address	2023-08-30 16:18:16 +02:00
netfilter	netfilter: nfnetlink_osf: avoid OOB read	2023-09-19 12:23:00 +02:00
netlabel	netlabel: fix shift wrapping bug in netlbl_catmap_setlong()	2023-09-19 12:22:29 +02:00
netlink	netlink: Add __sock_i_ino() for __netlink_diag_dump().	2023-07-23 13:46:56 +02:00
netrom	netrom: Deny concurrent connect().	2023-09-19 12:22:35 +02:00
nfc	net: nfc: Fix use-after-free caused by nfc_llcp_find_local	2023-07-23 13:46:56 +02:00
nsh	net: nsh: Use correct mac_offset to unwind gso skb in nsh_gso_segment()	2023-05-24 17:36:51 +01:00
openvswitch	net: openvswitch: fix possible memory leak in ovs_meter_cmd_set()	2023-02-22 12:57:09 +01:00
packet	net/packet: annotate data-races around tp->status	2023-08-16 18:22:01 +02:00
phonet	phonet: refcount leak in pep_sock_accep	2022-01-11 15:35:16 +01:00
psample	psample: Add additional metadata attributes	2021-03-14 15:00:43 -07:00
qrtr	net: qrtr: Fix an uninit variable access bug in qrtr_tx_resume()	2023-04-20 12:13:53 +02:00
rds	rds: rds_rm_zerocopy_callback() correct order for list_add_tail()	2023-03-10 09:39:16 +01:00
rfkill	rfkill: make new event layout opt-in	2022-04-08 14:23:00 +02:00
rose	net/rose: Fix to not accept on connected socket	2023-02-22 12:57:02 +01:00
rxrpc	rxrpc: Fix hard call timeout units	2023-05-17 11:50:17 +02:00
sched	net: sched: sch_qfq: Fix UAF in qfq_dequeue()	2023-09-19 12:22:59 +02:00
sctp	sctp: annotate data-races around sk->sk_wmem_queued	2023-09-19 12:22:58 +02:00
smc	net/smc: Avoid to access invalid RMBs' MRs in SMCRv1 ADD LINK CONT	2023-06-14 11:13:01 +02:00
strparser	bpf: sockmap, strparser, and tls are reusing qdisc_skb_cb and colliding	2021-11-18 19:17:11 +01:00
sunrpc	xprtrdma: Remap Receive buffers after a reconnect	2023-08-30 16:18:10 +02:00
switchdev	net: make switchdev_bridge_port_{,unoffload} loosely coupled with the bridge	2021-08-04 12:35:07 +01:00
tipc	tipc: stop tipc crypto on failure in tipc_node_create	2023-08-03 10:22:37 +02:00
tls	net: tls: avoid discarding data on record close	2023-08-26 14:23:22 +02:00
unix	af_unix: Fix data-race around unix_tot_inflight.	2023-09-19 12:22:59 +02:00
vmw_vsock	vsock: avoid to close connected socket after the timeout	2023-05-24 17:36:49 +01:00
wireless	wifi: nl80211/cfg80211: add forgotten nla_policy for BSS color attribute	2023-09-19 12:22:34 +02:00
x25	net/x25: Fix to not accept on connected socket	2023-02-09 11:26:40 +01:00
xdp	xsk: Fix xsk_diag use-after-free error during socket cleanup	2023-09-19 12:22:58 +02:00
xfrm	xfrm: add forgotten nla_policy for XFRMA_MTIMER_THRESH	2023-08-26 14:23:33 +02:00
Kconfig	Remove DECnet support from kernel	2023-06-21 15:59:15 +02:00
Makefile	Remove DECnet support from kernel	2023-06-21 15:59:15 +02:00
compat.c	net: Return the correct errno code	2021-06-03 15:13:56 -07:00
devres.c	net: devres: Correct a grammatical error	2021-06-11 12:55:28 -07:00
socket.c	net: Avoid address overwrite in kernel_connect	2023-09-19 12:22:30 +02:00
sysctl_net.c	net: Ensure net namespace isolation of sysctls	2021-04-12 13:27:11 -07:00