| commit | 274b1e779114c4e58a62fee4f839d1a4dbf719e1 | [log] [tgz] |
|---|---|---|
| author | Pablo Neira Ayuso <[email protected]> | Fri Mar 01 00:11:10 2024 +0100 |
| committer | Anil Altinay <[email protected]> | Sun Apr 14 02:59:27 2024 +0000 |
| tree | 03181b05c182bc7693b7bfae179ffa4824e59395 | |
| parent | 47d02fbe860d9b0cbcd6c4d0c92fb3f90bace5ab [diff] |
netfilter: nf_tables: disallow anonymous set with timeout flag commit 16603605b667b70da974bea8216c93e7db043bf1 upstream. Anonymous sets are never used with timeout from userspace, reject this. Exception to this rule is NFT_SET_EVAL to ensure legacy meters still work. Cc: [email protected] Fixes: 761da2935d6e ("netfilter: nf_tables: add set timeout API support") Reported-by: lonial con <[email protected]> Signed-off-by: Pablo Neira Ayuso <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]> BUG=b/333551758 TEST=presubmit RELEASE_NOTE=Fixed CVE-2024-26642 in the Linux kernel. cos-patch: security-moderate Change-Id: Idb03fa83a4c96bf91451b1abff61381140687ceb Reviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/69151 Tested-by: Cusky Presubmit Bot <[email protected]> Reviewed-by: Oleksandr Tymoshenko <[email protected]>