| Message ID | 1456346083-15562-1-git-send-email-phil.turnbull@oracle.com |
|---|---|
| State | Accepted |
| Delegated to: | Pablo Neira |
| Headers | show |
On Wed, Feb 24, 2016 at 03:34:43PM -0500, Phil Turnbull wrote: > nfacct_filter_alloc doesn't validate the NFACCT_FILTER_MASK and > NFACCT_FILTER_VALUE parameters which can trigger a NULL pointer > dereference. CAP_NET_ADMIN is required to trigger the bug. Applied, thanks. I have enqueued this to -stable: 3.18, 4.1 and 4.4 -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/net/netfilter/nfnetlink_acct.c b/net/netfilter/nfnetlink_acct.c index 5274b04..4c2b4c0 100644 --- a/net/netfilter/nfnetlink_acct.c +++ b/net/netfilter/nfnetlink_acct.c @@ -242,6 +242,9 @@ nfacct_filter_alloc(const struct nlattr * const attr) if (err < 0) return ERR_PTR(err); + if (!tb[NFACCT_FILTER_MASK] || !tb[NFACCT_FILTER_VALUE]) + return ERR_PTR(-EINVAL); + filter = kzalloc(sizeof(struct nfacct_filter), GFP_KERNEL); if (!filter) return ERR_PTR(-ENOMEM);
nfacct_filter_alloc doesn't validate the NFACCT_FILTER_MASK and NFACCT_FILTER_VALUE parameters which can trigger a NULL pointer dereference. CAP_NET_ADMIN is required to trigger the bug. Signed-off-by: Phil Turnbull <phil.turnbull@oracle.com> --- net/netfilter/nfnetlink_acct.c | 3 +++ 1 file changed, 3 insertions(+)