Commit fab2f61c authored Aug 09, 2022 by Thadeu Lima de Souza Cascardo Committed by Greg Kroah-Hartman Aug 25, 2022

netfilter: nf_tables: do not allow SET_ID to refer to another table



commit 470ee20e069a6d05ae549f7d0ef2bdbcee6a81b2 upstream.

When doing lookups for sets on the same batch by using its ID, a set from a
different table can be used.

Then, when the table is removed, a reference to the set may be kept after
the set is freed, leading to a potential use-after-free.

When looking for sets by ID, use the table that was used for the lookup by
name, and only return sets belonging to that same table.

This fixes CVE-2022-2586, also reported as ZDI-CAN-17470.

Reported-by: Team Orca of Sea Security <(@seasecresponse)>
Fixes: 958bee14 ("netfilter: nf_tables: use new transaction infrastructure to handle sets")
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

parent cc525d66

net/netfilter/nf_tables_api.c

+3 −1

Original line number	Diff line number	Diff line
		@@ -3191,6 +3191,7 @@ static struct nft_set nft_set_lookup_byhandle(const struct nft_table table,
		}

		static struct nft_set nft_set_lookup_byid(const struct net net,
		const struct nft_table *table,
		const struct nlattr *nla, u8 genmask)
		{
		struct nft_trans *trans;
		@@ -3201,6 +3202,7 @@ static struct nft_set nft_set_lookup_byid(const struct net net,
		struct nft_set *set = nft_trans_set(trans);

		if (id == nft_trans_set_id(trans) &&
		set->table == table &&
		nft_active_genmask(set, genmask))
		return set;
		}
		@@ -3221,7 +3223,7 @@ struct nft_set nft_set_lookup_global(const struct net net,
		if (!nla_set_id)
		return set;

		set = nft_set_lookup_byid(net, nla_set_id, genmask);
		set = nft_set_lookup_byid(net, table, nla_set_id, genmask);
		}
		return set;
		}