mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-29 13:53:33 +00:00
netfilter: nf_tables: do not allow SET_ID to refer to another table
commit470ee20e06
upstream. When doing lookups for sets on the same batch by using its ID, a set from a different table can be used. Then, when the table is removed, a reference to the set may be kept after the set is freed, leading to a potential use-after-free. When looking for sets by ID, use the table that was used for the lookup by name, and only return sets belonging to that same table. This fixes CVE-2022-2586, also reported as ZDI-CAN-17470. Reported-by: Team Orca of Sea Security (@seasecresponse) Fixes:958bee14d0
("netfilter: nf_tables: use new transaction infrastructure to handle sets") Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com> Cc: <stable@vger.kernel.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
2132cb1684
commit
f4fa03410f
1 changed files with 3 additions and 1 deletions
|
@ -3840,6 +3840,7 @@ static struct nft_set *nft_set_lookup_byhandle(const struct nft_table *table,
|
|||
}
|
||||
|
||||
static struct nft_set *nft_set_lookup_byid(const struct net *net,
|
||||
const struct nft_table *table,
|
||||
const struct nlattr *nla, u8 genmask)
|
||||
{
|
||||
struct nftables_pernet *nft_net = nft_pernet(net);
|
||||
|
@ -3851,6 +3852,7 @@ static struct nft_set *nft_set_lookup_byid(const struct net *net,
|
|||
struct nft_set *set = nft_trans_set(trans);
|
||||
|
||||
if (id == nft_trans_set_id(trans) &&
|
||||
set->table == table &&
|
||||
nft_active_genmask(set, genmask))
|
||||
return set;
|
||||
}
|
||||
|
@ -3871,7 +3873,7 @@ struct nft_set *nft_set_lookup_global(const struct net *net,
|
|||
if (!nla_set_id)
|
||||
return set;
|
||||
|
||||
set = nft_set_lookup_byid(net, nla_set_id, genmask);
|
||||
set = nft_set_lookup_byid(net, table, nla_set_id, genmask);
|
||||
}
|
||||
return set;
|
||||
}
|
||||
|
|
Loading…
Reference in a new issue