Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 64c0b8e6 authored by Pablo Neira Ayuso's avatar Pablo Neira Ayuso Committed by Greg Kroah-Hartman
Browse files

netfilter: ctnetlink: use helper function to calculate expect ID 



[ Upstream commit 782161895eb4ac45cf7cfa8db375bd4766cb8299 ]

Delete expectation path is missing a call to the nf_expect_get_id()
helper function to calculate the expectation ID, otherwise LSB of the
expectation object address is leaked to userspace.

Fixes: 3c791076 ("netfilter: ctnetlink: don't use conntrack/expect object addresses as id")
Reported-by: default avatar <zdi-disclosures@trendmicro.com>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent 55fa4883

net/netfilter/nf_conntrack_netlink.c

+2 −1
Original line number Diff line number Diff line
@@ -3129,7 +3129,8 @@ static int ctnetlink_del_expect(struct net *net, struct sock *ctnl, 


		if (cda[CTA_EXPECT_ID]) {

			__be32 id = nla_get_be32(cda[CTA_EXPECT_ID]);

			if (ntohl(id) != (u32)(unsigned long)exp) {



			if (id != nf_expect_get_id(exp)) {

				nf_ct_expect_put(exp);

				return -ENOENT;

			}