| commit | 274b1e779114c4e58a62fee4f839d1a4dbf719e1 | [log] [tgz] |
|---|---|---|
| author | Pablo Neira Ayuso <[email protected]> | Fri Mar 01 00:11:10 2024 +0100 |
| committer | Anil Altinay <[email protected]> | Sun Apr 14 02:59:27 2024 +0000 |
| tree | 03181b05c182bc7693b7bfae179ffa4824e59395 | |
| parent | 47d02fbe860d9b0cbcd6c4d0c92fb3f90bace5ab [diff] |
netfilter: nf_tables: disallow anonymous set with timeout flag commit 16603605b667b70da974bea8216c93e7db043bf1 upstream. Anonymous sets are never used with timeout from userspace, reject this. Exception to this rule is NFT_SET_EVAL to ensure legacy meters still work. Cc: [email protected] Fixes: 761da2935d6e ("netfilter: nf_tables: add set timeout API support") Reported-by: lonial con <[email protected]> Signed-off-by: Pablo Neira Ayuso <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]> BUG=b/333551758 TEST=presubmit RELEASE_NOTE=Fixed CVE-2024-26642 in the Linux kernel. cos-patch: security-moderate Change-Id: Idb03fa83a4c96bf91451b1abff61381140687ceb Reviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/69151 Tested-by: Cusky Presubmit Bot <[email protected]> Reviewed-by: Oleksandr Tymoshenko <[email protected]>
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index 4f2ded6..a83bb84 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c
@@ -4708,6 +4708,9 @@ if ((flags & (NFT_SET_EVAL | NFT_SET_OBJECT)) == (NFT_SET_EVAL | NFT_SET_OBJECT)) return -EOPNOTSUPP; + if ((flags & (NFT_SET_ANONYMOUS | NFT_SET_TIMEOUT | NFT_SET_EVAL)) == + (NFT_SET_ANONYMOUS | NFT_SET_TIMEOUT)) + return -EOPNOTSUPP; } desc.dtype = 0;