]> git.ipfire.org Git - thirdparty/nftables.git/commit
netlink: fix stack buffer overflow with sub-reg sized prefixes
authorFlorian Westphal <fw@strlen.de>
Wed, 13 Dec 2023 16:41:26 +0000 (17:41 +0100)
committerFlorian Westphal <fw@strlen.de>
Fri, 15 Dec 2023 01:28:15 +0000 (02:28 +0100)
commit600b84631410a6e853c208795246ea0c9df95c12
treeaba47213f3e16b7d3fa8ca300a9551b8ba0b2cc5
parentef10d65db278d77208e960d210a1f4f532ebb552
netlink: fix stack buffer overflow with sub-reg sized prefixes

The calculation of the dynamic on-stack array is incorrect,
the scratch space can be too low which gives stack corruption:

AddressSanitizer: dynamic-stack-buffer-overflow on address 0x7ffdb454f064..
    #1 0x7fabe92aaac4 in __mpz_export_data src/gmputil.c:108
    #2 0x7fabe92d71b1 in netlink_export_pad src/netlink.c:251
    #3 0x7fabe92d91d8 in netlink_gen_prefix src/netlink.c:476

div_round_up() cannot be used here, it fails to account for register
padding.  A 16 bit prefix will need 2 registers (start, end -- 8 bytes
in total).

Remove the dynamic sizing and add an assertion in case upperlayer
ever passes invalid expr sizes down to us.

After this fix, the combination is rejected by the kernel
because of the maps' wrong data size, before the fix userspace
may crash before.

Signed-off-by: Florian Westphal <fw@strlen.de>
src/netlink.c
tests/shell/testcases/bogons/nft-f/dynamic-stack-buffer-overflow_gen_prefix [new file with mode: 0644]