Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 721ea8ac authored by Pablo Neira Ayuso's avatar Pablo Neira Ayuso Committed by Greg Kroah-Hartman
Browse files

netfilter: nfnetlink_osf: fix possible bogus match in nf_osf_find() 



[ Upstream commit 559c36c5a8d730c49ef805a72b213d3bba155cc8 ]

nf_osf_find() incorrectly returns true on mismatch, this leads to
copying uninitialized memory area in nft_osf which can be used to leak
stale kernel stack data to userspace.

Fixes: 22c7652c ("netfilter: nft_osf: Add version option support")
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent d0a24bc8

net/netfilter/nfnetlink_osf.c

+3 −1
Original line number Diff line number Diff line
@@ -269,6 +269,7 @@ bool nf_osf_find(const struct sk_buff *skb, 
	struct nf_osf_hdr_ctx ctx;

	const struct tcphdr *tcp;

	struct tcphdr _tcph;

	bool found = false;



	memset(&ctx, 0, sizeof(ctx));
@@ -283,10 +284,11 @@ bool nf_osf_find(const struct sk_buff *skb, 


		data->genre = f->genre;

		data->version = f->version;

		found = true;

		break;

	}



	return true;

	return found;

}

EXPORT_SYMBOL_GPL(nf_osf_find);