tree 0becc310cebedccbf802fdc6c517aeecb50fe36f
parent 1d2d8d2b6fb9010ce5c059f37f1e02f6050073a2
author Florian Westphal <fw@strlen.de> 1689793701 +0200
committer Oleksandr Tymoshenko <ovt@google.com> 1691450925 +0000

netfilter: nft_set_pipapo: fix improper element removal

[ Upstream commit 87b5a5c209405cb6b57424cdfa226a6dbd349232 ]

end key should be equal to start unless NFT_SET_EXT_KEY_END is present.

Its possible to add elements that only have a start key
("{ 1.0.0.0 . 2.0.0.0 }") without an internval end.

Insertion treats this via:

if (nft_set_ext_exists(ext, NFT_SET_EXT_KEY_END))
   end = (const u8 *)nft_set_ext_key_end(ext)->data;
else
   end = start;

but removal side always uses nft_set_ext_key_end().
This is wrong and leads to garbage remaining in the set after removal
next lookup/insert attempt will give:

BUG: KASAN: slab-use-after-free in pipapo_get+0x8eb/0xb90
Read of size 1 at addr ffff888100d50586 by task nft-pipapo_uaf_/1399
Call Trace:
 kasan_report+0x105/0x140
 pipapo_get+0x8eb/0xb90
 nft_pipapo_insert+0x1dc/0x1710
 nf_tables_newsetelem+0x31f5/0x4e00
 ..

BUG=294663116
TESTS=presubmit
RELEASE_NOTE=Fixed CVE-2023-4004 in the Linux kernel.

cos-patch: security-high
Fixes: 3c4287f62044 ("nf_tables: Add set type for arbitrary concatenation of ranges")
Reported-by: lonial con <kongln9170@gmail.com>
Reviewed-by: Stefano Brivio <sbrivio@redhat.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Oleksandr Tymoshenko <ovt@google.com>
Change-Id: Ia43621d7bf25d0ca37c8793dc5e8c2eb949acfad
Reviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/54007
Reviewed-by: Arnav Kansal <rnv@google.com>
Tested-by: Cusky Presubmit Bot <presubmit@cos-infra-prod.iam.gserviceaccount.com>