mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-24 17:59:32 +00:00
netfilter: nfnetlink_osf: fix possible bogus match in nf_osf_find()
[ Upstream commit559c36c5a8
] nf_osf_find() incorrectly returns true on mismatch, this leads to copying uninitialized memory area in nft_osf which can be used to leak stale kernel stack data to userspace. Fixes:22c7652cda
("netfilter: nft_osf: Add version option support") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
parent
d0a24bc8e2
commit
721ea8ac06
1 changed files with 3 additions and 1 deletions
|
@ -269,6 +269,7 @@ bool nf_osf_find(const struct sk_buff *skb,
|
||||||
struct nf_osf_hdr_ctx ctx;
|
struct nf_osf_hdr_ctx ctx;
|
||||||
const struct tcphdr *tcp;
|
const struct tcphdr *tcp;
|
||||||
struct tcphdr _tcph;
|
struct tcphdr _tcph;
|
||||||
|
bool found = false;
|
||||||
|
|
||||||
memset(&ctx, 0, sizeof(ctx));
|
memset(&ctx, 0, sizeof(ctx));
|
||||||
|
|
||||||
|
@ -283,10 +284,11 @@ bool nf_osf_find(const struct sk_buff *skb,
|
||||||
|
|
||||||
data->genre = f->genre;
|
data->genre = f->genre;
|
||||||
data->version = f->version;
|
data->version = f->version;
|
||||||
|
found = true;
|
||||||
break;
|
break;
|
||||||
}
|
}
|
||||||
|
|
||||||
return true;
|
return found;
|
||||||
}
|
}
|
||||||
EXPORT_SYMBOL_GPL(nf_osf_find);
|
EXPORT_SYMBOL_GPL(nf_osf_find);
|
||||||
|
|
||||||
|
|
Loading…
Reference in a new issue