From 678eb359548e81a8c91657115ca22bd6862dd18d Mon Sep 17 00:00:00 2001
From: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
Date: Tue, 9 Aug 2022 14:01:46 -0300
Subject: [PATCH 2/2] netfilter: nf_tables: do not allow SET_ID to refer to
another table
Git-commit: 470ee20e069a6d05ae549f7d0ef2bdbcee6a81b2
Patch-mainline: v6.0-rc1
References: bsc#1202095 CVE-2022-2586
When doing lookups for sets on the same batch by using its ID, a set from a
different table can be used.
Then, when the table is removed, a reference to the set may be kept after
the set is freed, leading to a potential use-after-free.
When looking for sets by ID, use the table that was used for the lookup by
name, and only return sets belonging to that same table.
This fixes CVE-2022-2586, also reported as ZDI-CAN-17470.
Reported-by: Team Orca of Sea Security (@seasecresponse)
Fixes: 958bee14d071 ("netfilter: nf_tables: use new transaction infrastructure to handle sets")
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Denis Kirjanov <denis.kirjanov@suse.com>
---
net/netfilter/nf_tables_api.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index c4e94e4cc5b8..5f6d3a30b4ea 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -2558,6 +2558,7 @@ static struct nft_set *nf_tables_set_lookup(const struct nft_table *table,
}
static struct nft_set *nf_tables_set_lookup_byid(const struct net *net,
+ const struct nft_table *table,
const struct nlattr *nla,
u8 genmask)
{
@@ -2569,6 +2570,7 @@ static struct nft_set *nf_tables_set_lookup_byid(const struct net *net,
struct nft_set *set = nft_trans_set(trans);
if (id == nft_trans_set_id(trans) &&
+ set->table == table &&
nft_active_genmask(set, genmask))
return set;
}
@@ -2589,7 +2591,7 @@ struct nft_set *nft_set_lookup(const struct net *net,
if (!nla_set_id)
return set;
- set = nf_tables_set_lookup_byid(net, nla_set_id, genmask);
+ set = nf_tables_set_lookup_byid(net, table, nla_set_id, genmask);
}
return set;
}
@@ -3910,6 +3912,7 @@ static int nf_tables_newsetelem(struct net *net, struct sock *nlsk,
if (IS_ERR(set)) {
if (nla[NFTA_SET_ELEM_LIST_SET_ID]) {
set = nf_tables_set_lookup_byid(net,
+ ctx.table,
nla[NFTA_SET_ELEM_LIST_SET_ID],
genmask);
}
--
2.16.4