mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/
synced 2026-09-18 18:15:59 +00:00
590bdf7fd2
There is a number of issues in parsing user-provided table in translate_table(). Malicious user with CAP_NET_ADMIN may crash system by passing special-crafted table to the *_tables. The first issue is that mark_source_chains() function is called before entry content checks. In case of standard target, mark_source_chains() function uses t->verdict field in order to determine new position. But the check, that this field leads no further, than the table end, is in check_entry(), which is called later, than mark_source_chains(). The second issue, that there is no check that target_offset points inside entry. If so, *_ITERATE_MATCH macro will follow further, than the entry ends. As a result, we'll have oops or memory disclosure. And the third issue, that there is no check that the target is completely inside entry. Results are the same, as in previous issue. Signed-off-by: Dmitry Mishin <dim@openvz.org> Acked-by: Kirill Korotaev <dev@openvz.org> Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net> |
History
|
|
|---|---|---|
| .. | ||
| ip6_queue.c | ||
| ip6_tables.c | ||
| ip6t_ah.c | ||
| ip6t_eui64.c | ||
| ip6t_frag.c | ||
| ip6t_hbh.c | ||
| ip6t_HL.c | ||
| ip6t_hl.c | ||
| ip6t_ipv6header.c | ||
| ip6t_LOG.c | ||
| ip6t_owner.c | ||
| ip6t_REJECT.c | ||
| ip6t_rt.c | ||
| ip6table_filter.c | ||
| ip6table_mangle.c | ||
| ip6table_raw.c | ||
| Kconfig | ||
| Makefile | ||
| nf_conntrack_l3proto_ipv6.c | ||
| nf_conntrack_proto_icmpv6.c | ||
| nf_conntrack_reasm.c | ||