Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 71df14b0 authored by Pablo Neira Ayuso's avatar Pablo Neira Ayuso
Browse files

netfilter: nf_tables: missing sanitization in data from userspace 



Do not assume userspace always sends us NFT_DATA_VALUE for bitwise and
cmp expressions. Although NFT_DATA_VERDICT does not make any sense, it
is still possible to handcraft a netlink message using this incorrect
data type.

Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent fa803605

net/netfilter/nft_bitwise.c

+14 −5
Original line number Diff line number Diff line
@@ -83,17 +83,26 @@ static int nft_bitwise_init(const struct nft_ctx *ctx, 
			    tb[NFTA_BITWISE_MASK]);

	if (err < 0)

		return err;

	if (d1.len != priv->len)

		return -EINVAL;

	if (d1.len != priv->len) {

		err = -EINVAL;

		goto err1;

	}



	err = nft_data_init(NULL, &priv->xor, sizeof(priv->xor), &d2,

			    tb[NFTA_BITWISE_XOR]);

	if (err < 0)

		return err;

	if (d2.len != priv->len)

		return -EINVAL;

		goto err1;

	if (d2.len != priv->len) {

		err = -EINVAL;

		goto err2;

	}



	return 0;

err2:

	nft_data_uninit(&priv->xor, d2.type);

err1:

	nft_data_uninit(&priv->mask, d1.type);

	return err;

}



static int nft_bitwise_dump(struct sk_buff *skb, const struct nft_expr *expr)

net/netfilter/nft_cmp.c

+10 −2
Original line number Diff line number Diff line
@@ -201,10 +201,18 @@ nft_cmp_select_ops(const struct nft_ctx *ctx, const struct nlattr * const tb[]) 
	if (err < 0)

		return ERR_PTR(err);



	if (desc.type != NFT_DATA_VALUE) {

		err = -EINVAL;

		goto err1;

	}



	if (desc.len <= sizeof(u32) && op == NFT_CMP_EQ)

		return &nft_cmp_fast_ops;

	else



	return &nft_cmp_ops;

err1:

	nft_data_uninit(&data, desc.type);

	return ERR_PTR(-EINVAL);

}



struct nft_expr_type nft_cmp_type __read_mostly = {