kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-20 19:23:40 +00:00
Code Issues Releases Packages Activity
No description
1,063,738 commits 117 branches 5,799 tags 5.6 GiB
  • C 96.9%
  • Assembly 0.9%
  • Rust 0.6%
  • Shell 0.6%
  • Python 0.5%
  • Other 0.3%
Find a file
Wander Lairson Costa 19280e8dfb netfilter: nfnetlink_osf: avoid OOB read 
[ Upstream commit f4f8a78031 ]

The opt_num field is controlled by user mode and is not currently
validated inside the kernel. An attacker can take advantage of this to
trigger an OOB read and potentially leak information.

BUG: KASAN: slab-out-of-bounds in nf_osf_match_one+0xbed/0xd10 net/netfilter/nfnetlink_osf.c:88
Read of size 2 at addr ffff88804bc64272 by task poc/6431

CPU: 1 PID: 6431 Comm: poc Not tainted 6.0.0-rc4 #1
Call Trace:
 nf_osf_match_one+0xbed/0xd10 net/netfilter/nfnetlink_osf.c:88
 nf_osf_find+0x186/0x2f0 net/netfilter/nfnetlink_osf.c:281
 nft_osf_eval+0x37f/0x590 net/netfilter/nft_osf.c:47
 expr_call_ops_eval net/netfilter/nf_tables_core.c:214
 nft_do_chain+0x2b0/0x1490 net/netfilter/nf_tables_core.c:264
 nft_do_chain_ipv4+0x17c/0x1f0 net/netfilter/nft_chain_filter.c:23
 [..]

Also add validation to genre, subtype and version fields.

Fixes: 11eeef41d5 ("netfilter: passive OS fingerprint xtables match")
Reported-by: Lucas Leong <wmliang@infosec.exchange>
Signed-off-by: Wander Lairson Costa <wander@redhat.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
History 2023-09-19 12:23:00 +02:00
arch x86/virt: Drop unnecessary check on extended CPUID level in cpu_has_svm() 2023-09-19 12:22:57 +02:00
block block/partition: fix signedness issue for Amiga partitions 2023-07-23 13:47:37 +02:00
certs certs/blacklist_hashes.c: fix const confusion in certs blacklist 2022-06-22 14:22:01 +02:00
crypto X.509: if signature is unsupported skip validation 2023-09-19 12:22:52 +02:00
Documentation dt-bindings: clock: xlnx,versal-clk: drop select:false 2023-09-19 12:22:56 +02:00
drivers net: dsa: sja1105: complete tc-cbs offload support on SJA1110 2023-09-19 12:23:00 +02:00
fs gfs2: low-memory forced flush fixes 2023-09-19 12:22:56 +02:00
include ip_tunnels: use DEV_STATS_INC() 2023-09-19 12:22:59 +02:00
init x86/mm: Initialize text poking earlier 2023-08-08 19:58:33 +02:00
io_uring io_uring: break iopolling on signal 2023-09-19 12:22:54 +02:00
ipc ipc/sem: Fix dangling sem_array access in semtimedop race 2022-12-08 11:28:45 +01:00
kernel tracing: Zero the pipe cpumask on alloc to avoid spurious -EBUSY 2023-09-19 12:22:53 +02:00
lib idr: fix param name in idr_alloc_cyclic() doc 2023-09-19 12:22:59 +02:00
LICENSES LICENSES/dual/CC-BY-4.0: Git rid of "smart quotes" 2021-07-15 06:31:24 -06:00
mm mm/vmalloc: add a safer version of find_vm_area() for debug 2023-09-19 12:22:50 +02:00
net netfilter: nfnetlink_osf: avoid OOB read 2023-09-19 12:23:00 +02:00
samples samples/bpf: fix broken map lookup probe 2023-09-19 12:22:34 +02:00
scripts kconfig: fix possible buffer overflow 2023-09-19 12:22:56 +02:00
security smackfs: Prevent underflow in smk_set_cipso() 2023-09-19 12:22:39 +02:00
sound ALSA: pcm: Fix missing fixup call in compat hw_refine ioctl 2023-09-19 12:22:50 +02:00
tools perf top: Don't pass an ERR_PTR() directly to perf_session__delete() 2023-09-19 12:22:57 +02:00
usr usr/include/Makefile: add linux/nfc.h to the compile-test coverage 2022-02-01 17:27:15 +01:00
virt KVM: Grab a reference to KVM for VM and vCPU stats file descriptors 2023-08-03 10:22:40 +02:00
.clang-format clang-format: Update with the latest for_each macro list 2021-05-12 23:32:39 +02:00
.cocciconfig scripts: add Linux .cocciconfig for coccinelle 2016-07-22 12:13:39 +02:00
.get_maintainer.ignore Opt out of scripts/get_maintainer.pl 2019-05-16 10:53:40 -07:00
.gitattributes .gitattributes: use 'dts' diff driver for dts files 2019-12-04 19:44:11 -08:00
.gitignore .gitignore: ignore only top-level modules.builtin 2021-05-02 00:43:35 +09:00
.mailmap mailmap: add Andrej Shadura 2021-10-18 20:22:03 -10:00
COPYING COPYING: state that all contributions really are covered by this file 2020-02-10 13:32:20 -08:00
CREDITS MAINTAINERS: Move Daniel Drake to credits 2021-09-21 08:34:58 +03:00
Kbuild kbuild: rename hostprogs-y/always to hostprogs/always-y 2020-02-04 01:53:07 +09:00
Kconfig kbuild: ensure full rebuild when the compiler is updated 2020-05-12 13:28:33 +09:00
MAINTAINERS iio: stx104: Move to addac subdirectory 2023-08-26 14:23:27 +02:00
Makefile kbuild: do not run depmod for 'make modules_sign' 2023-09-19 12:22:56 +02:00
README Drop all 00-INDEX files from Documentation/ 2018-09-09 15:08:58 -06:00

README 

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.