tree 230ec35845bf6074f715fb1b3184813700e08561
parent 16df926aa56545c2131c43d3e161df5a61d50bfd
author Florian Westphal <fw@strlen.de> 1658832126 +0200
committer Ke Wu <mikewu@google.com> 1662796175 +0000

netfilter: nf_queue: do not allow packet truncation below transport header offset

[ Upstream commit 99a63d36cb3ed5ca3aa6fcb64cffbeaf3b0fb164 ]

Domingo Dirutigliano and Nicola Guerrera report kernel panic when
sending nf_queue verdict with 1-byte nfta_payload attribute.

The IP/IPv6 stack pulls the IP(v6) header from the packet after the
input hook.

If user truncates the packet below the header size, this skb_pull() will
result in a malformed skb (skb->len < 0).

BUG=b/241534002
TEST=presubmit
RELEASE_NOTE=Fixed CVE-2022-36946 in the Linux kernel.

Fixes: 7af4cc3fa158 ("[NETFILTER]: Add "nfnetlink_queue" netfilter queue handler over nfnetlink")
Reported-by: Domingo Dirutigliano <pwnzer0tt1@proton.me>
Signed-off-by: Florian Westphal <fw@strlen.de>
Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

cos-patch: security-high
Change-Id: I55fc69adfdcfccb5dab8a2abce66dcea767c595e
Reviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/36795
Tested-by: Cusky Presubmit Bot <presubmit@cos-infra-prod.iam.gserviceaccount.com>
Reviewed-by: Vaibhav Rustagi <vaibhavrustagi@google.com>