netfilter: x_tables: don't move to non-existent next rule

Browse source

[ Upstream commit f24e230d25 ]

Ben Hawkes says:

 In the mark_source_chains function (net/ipv4/netfilter/ip_tables.c) it
 is possible for a user-supplied ipt_entry structure to have a large
 next_offset field. This field is not bounds checked prior to writing a
 counter value at the supplied offset.

Base chains enforce absolute verdict.

User defined chains are supposed to end with an unconditional return,
xtables userspace adds them automatically.

But if such return is missing we will move to non-existent next rule.

Reported-by: Ben Hawkes <hawkes@google.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sasha.levin@oracle.com>

...

This commit is contained in:

Florian Westphal 2016-04-01 14:17:21 +02:00 • committed by Sasha Levin

parent c2a1b8ee3f

commit d1fe825ef2

3 changed files with 13 additions and 3 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

8

net/ipv4/netfilter/arp_tables.c

View file

4

net/ipv4/netfilter/ip_tables.c

View file

4

net/ipv6/netfilter/ip6_tables.c

View file