Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e4d091d7 authored by Dan Carpenter's avatar Dan Carpenter Committed by Pablo Neira Ayuso
Browse files

netfilter: nfnetlink_{log,queue}: fix information leaks in netlink message 



These structs have a "_pad" member.  Also the "phw" structs have an 8
byte "hw_addr[]" array but sometimes only the first 6 bytes are
initialized.

Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent a206bcb3

net/netfilter/nfnetlink_log.c

+5 −1
Original line number Original line Diff line number Diff line
@@ -419,6 +419,7 @@ __build_packet_message(struct nfnl_log_net *log, 
	nfmsg->version = NFNETLINK_V0;

	nfmsg->version = NFNETLINK_V0;

	nfmsg->res_id = htons(inst->group_num);

	nfmsg->res_id = htons(inst->group_num);





	memset(&pmsg, 0, sizeof(pmsg));

	pmsg.hw_protocol	= skb->protocol;

	pmsg.hw_protocol	= skb->protocol;

	pmsg.hook		= hooknum;

	pmsg.hook		= hooknum;
@@ -498,7 +499,10 @@ __build_packet_message(struct nfnl_log_net *log, 
	if (indev && skb->dev &&

	if (indev && skb->dev &&

	    skb->mac_header != skb->network_header) {

	    skb->mac_header != skb->network_header) {

		struct nfulnl_msg_packet_hw phw;

		struct nfulnl_msg_packet_hw phw;

		int len = dev_parse_header(skb, phw.hw_addr);

		int len;



		memset(&phw, 0, sizeof(phw));

		len = dev_parse_header(skb, phw.hw_addr);

		if (len > 0) {

		if (len > 0) {

			phw.hw_addrlen = htons(len);

			phw.hw_addrlen = htons(len);

			if (nla_put(inst->skb, NFULA_HWADDR, sizeof(phw), &phw))

			if (nla_put(inst->skb, NFULA_HWADDR, sizeof(phw), &phw))

net/netfilter/nfnetlink_queue_core.c

+4 −1
Original line number Original line Diff line number Diff line
@@ -463,7 +463,10 @@ nfqnl_build_packet_message(struct nfqnl_instance *queue, 
	if (indev && entskb->dev &&

	if (indev && entskb->dev &&

	    entskb->mac_header != entskb->network_header) {

	    entskb->mac_header != entskb->network_header) {

		struct nfqnl_msg_packet_hw phw;

		struct nfqnl_msg_packet_hw phw;

		int len = dev_parse_header(entskb, phw.hw_addr);

		int len;



		memset(&phw, 0, sizeof(phw));

		len = dev_parse_header(entskb, phw.hw_addr);

		if (len) {

		if (len) {

			phw.hw_addrlen = htons(len);

			phw.hw_addrlen = htons(len);

			if (nla_put(skb, NFQA_HWADDR, sizeof(phw), &phw))

			if (nla_put(skb, NFQA_HWADDR, sizeof(phw), &phw))