Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 7400bb4b authored by Tejaswi Tanikella's avatar Tejaswi Tanikella Committed by Pablo Neira Ayuso
Browse files

netfilter: nf_reject_ipv4: Fix use-after-free in send_reset 



niph is not updated after pskb_expand_head changes the skb head. It
still points to the freed data, which is then used to update tot_len and
checksum. This could cause use-after-free poison crash.

Update niph, if ip_route_me_harder does not fail.

This only affects the interaction with REJECT targets and br_netfilter.

Signed-off-by: default avatarTejaswi Tanikella <tejaswit@codeaurora.org>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 0414c78f

net/ipv4/netfilter/nf_reject_ipv4.c

+2 −0
Original line number Original line Diff line number Diff line
@@ -132,6 +132,8 @@ void nf_send_reset(struct net *net, struct sk_buff *oldskb, int hook) 
	if (ip_route_me_harder(net, nskb, RTN_UNSPEC))

	if (ip_route_me_harder(net, nskb, RTN_UNSPEC))

		goto free_nskb;

		goto free_nskb;





	niph = ip_hdr(nskb);



	/* "Never happens" */

	/* "Never happens" */

	if (nskb->len > dst_mtu(skb_dst(nskb)))

	if (nskb->len > dst_mtu(skb_dst(nskb)))

		goto free_nskb;

		goto free_nskb;