Re: [PATH nf v3] netfilter/osf: avoid OOB read

[Florian Westphal]

Wander Lairson Costa <wander@xxxxxxxxxx> wrote:
> The opt_num field is controlled by user mode and is not currently
> validated inside the kernel. An attacker can take advantage of this to
> trigger an OOB read and potentially leak information.
> 
> Also add validation to genre, subtype and version fields.

I was about to apply this but your patch misses the Signed-off-by line.

> Reproducer:
> 
> void install_filter_for_leak()
> {

Please remove this for v4, it only clutters the changelog.

> KASAN report:
> 
> ==================================================================
> BUG: KASAN: slab-out-of-bounds in nf_osf_match_one+0xbed/0xd10 linux-6.0-rc4/net/netfilter/nfnetlink_osf.c:88
> Read of size 2 at addr ffff88804bc64272 by task poc/6431
> 
> CPU: 1 PID: 6431 Comm: poc Not tainted 6.0.0-rc4 #1
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
> Call Trace:
>  <IRQ>
>  __dump_stack linux-6.0-rc4/lib/dump_stack.c:88
>  dump_stack_lvl+0xcd/0x134 linux-6.0-rc4/lib/dump_stack.c:106
>  print_address_description linux-6.0-rc4/mm/kasan/report.c:317
>  print_report.cold+0x2ba/0x6e9 linux-6.0-rc4/mm/kasan/report.c:433
>  kasan_report+0xb1/0x1e0 linux-6.0-rc4/mm/kasan/report.c:495
>  nf_osf_match_one+0xbed/0xd10 linux-6.0-rc4/net/netfilter/nfnetlink_osf.c:88
>  nf_osf_find+0x186/0x2f0 linux-6.0-rc4/net/netfilter/nfnetlink_osf.c:281
>  nft_osf_eval+0x37f/0x590 linux-6.0-rc4/net/netfilter/nft_osf.c:47
>  expr_call_ops_eval linux-6.0-rc4/net/netfilter/nf_tables_core.c:214
>  nft_do_chain+0x2b0/0x1490 linux-6.0-rc4/net/netfilter/nf_tables_core.c:264
>  nft_do_chain_ipv4+0x17c/0x1f0 linux-6.0-rc4/net/netfilter/nft_chain_filter.c:23
>  nf_hook_entry_hookfn linux-6.0-rc4/./include/linux/netfilter.h:142
>  nf_hook_slow+0xc5/0x1f0 linux-6.0-rc4/net/netfilter/core.c:620

You can keep the KASAN splat but please trim it down, anything below
here
doesn't add much value and neither does print_address_description etc.
above.

>  ffff88804bc64300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
> 
> ---

git-am chopped everything below off, so

> 
> Fixes: f9324952088f ("netfilter: nfnetlink_osf: extract nfnetlink_subsystem code from xt_osf.c")
> Reported-by: Lucas Leong <wmliang@infosec.exchange>
> Cc: stable@xxxxxxxxxx
> Signed-off-by: Wander Lairson Costa <wander@xxxxxxxxxx>

The above wasn't there when I looked at 'git log'.

I will fix this up locally, no need to resend,
but please keep this in mind next time.

Thanks!