[LTS 9.2] netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro for ip_… #326
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
…set_hash_netportnet.c jira VULN-6670 cve CVE-2023-42753 commit-author Kyle Zeng <zengyhkyle@gmail.com> commit 050d91c The missing IP_SET_HASH_WITH_NET0 macro in ip_set_hash_netportnet can lead to the use of wrong `CIDR_POS(c)` for calculating array offsets, which can lead to integer underflow. As a result, it leads to slab out-of-bound access. This patch adds back the IP_SET_HASH_WITH_NET0 macro to ip_set_hash_netportnet to address the issue. Fixes: 886503f ("netfilter: ipset: actually allow allowable CIDR 0 in hash:net,port,net") Suggested-by: Jozsef Kadlecsik <kadlec@netfilter.org> Signed-off-by: Kyle Zeng <zengyhkyle@gmail.com> Acked-by: Jozsef Kadlecsik <kadlec@netfilter.org> Signed-off-by: Florian Westphal <fw@strlen.de> (cherry picked from commit 050d91c) Signed-off-by: Marcin Wcisło <marcin.wcislo@conclusive.pl>
PlaidCat
requested review from
kerneltoast,
PlaidCat,
bmastbergen and
thefossguy-ciq
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
[LTS 9.2]
CVE-2023-42753
VULN-6670
Problem
https://nvd.nist.gov/vuln/detail/CVE-2023-42753
Original:
https://www.openwall.com/lists/oss-security/2023/09/22/10
Solution (same as #325)
The fix in mainline is given in 050d91c. All official backports have the same form. The fix is already present in Rockys CBR 7.9 (b0f9309), LTS 8.6 (fba0aaf) and LTS 9.4 (ab90fdc, ported by RedHat), all in the same form. It applies to LTS 9.2 smoothly as well.
kABI check: passed
Boot test: passed
boot-test.log
Kselftests: passed relative
Coverage
net(exceptgro.sh,udpgro_fwd.sh,ip_defrag.sh,reuseport_addr_any.sh,fib_nexthops.sh,xfrm_policy.sh,udpgso_bench.sh,reuseaddr_conflict,txtimestamp.sh),netfilter(exceptnft_trans_stress.sh)Following the discussion on Slack, and having established already what seems to be a set of stable tests for the LTS 9.2 version (no flappy results) - the only remaining reason for running full selftests routine for the last two months - a test run was done this time for the subsystems most likely affected by the change only.
Reference
kselftests–ciqlts9_2–run1.log
kselftests–ciqlts9_2–run2.log
Patch
kselftests–ciqlts9_2-CVE-2023-42753–run1.log
kselftests–ciqlts9_2-CVE-2023-42753–run2.log
Comparison
The test results are the same in the reference and patched kernel (presenting full results comparison):
Specific tests: skipped
After the fiasco of replicating the bug in version
ciqlts8_8using POC provided by the CVE author (#325) the plan to repeat it in versionciqlts9_2was abandoned. Can be resumed on request.