| commit | 9af9b855872be5470767b7c93bba2b7c893094cd | [log] [tgz] |
|---|---|---|
| author | Pablo Neira Ayuso <[email protected]> | Fri Mar 01 00:11:10 2024 +0100 |
| committer | COS Cherry Picker <[email protected]> | Mon Apr 15 15:32:48 2024 -0700 |
| tree | a783b5f4e3d873e7a0ea5814005c17fa61d0ba76 | |
| parent | 21efe59f621a5f4aa3e34a296b87e4e57b7881fa [diff] |
netfilter: nf_tables: disallow anonymous set with timeout flag commit 16603605b667b70da974bea8216c93e7db043bf1 upstream. Anonymous sets are never used with timeout from userspace, reject this. Exception to this rule is NFT_SET_EVAL to ensure legacy meters still work. Cc: [email protected] Fixes: 761da2935d6e ("netfilter: nf_tables: add set timeout API support") Reported-by: lonial con <[email protected]> Signed-off-by: Pablo Neira Ayuso <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]> BUG=b/333551897 TEST=presubmit RELEASE_NOTE=Fixed CVE-2024-26642 in the Linux kernel. cos-patch: security-moderate Change-Id: I2e59e16a2e156963ba3646bc3e3130238e401210 Reviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/69139 Tested-by: Cusky Presubmit Bot <[email protected]> Main-Branch-Verified: Cusky Presubmit Bot <[email protected]> Reviewed-by: Oleksandr Tymoshenko <[email protected]>