Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 017b1b6d authored by Phil Turnbull's avatar Phil Turnbull Committed by Pablo Neira Ayuso
Browse files

netfilter: nfnetlink_acct: validate NFACCT_FILTER parameters 



nfacct_filter_alloc doesn't validate the NFACCT_FILTER_MASK and
NFACCT_FILTER_VALUE parameters which can trigger a NULL pointer
dereference. CAP_NET_ADMIN is required to trigger the bug.

Signed-off-by: default avatarPhil Turnbull <phil.turnbull@oracle.com>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 472681d5

net/netfilter/nfnetlink_acct.c

+3 −0
Original line number Diff line number Diff line
@@ -242,6 +242,9 @@ nfacct_filter_alloc(const struct nlattr * const attr) 
	if (err < 0)

		return ERR_PTR(err);



	if (!tb[NFACCT_FILTER_MASK] || !tb[NFACCT_FILTER_VALUE])

		return ERR_PTR(-EINVAL);



	filter = kzalloc(sizeof(struct nfacct_filter), GFP_KERNEL);

	if (!filter)

		return ERR_PTR(-ENOMEM);