From 6631a62473656c61d7f82cda8ba490c9ba952b96 Mon Sep 17 00:00:00 2001 From: Joe Lawrence Date: Mon, 27 Nov 2023 15:50:24 -0500 Subject: [KPATCH CVE-2023-42753] kpatch fixes for CVE-2023-42753 Kernels: 3.10.0-1160.92.1.el7 3.10.0-1160.95.1.el7 3.10.0-1160.99.1.el7 3.10.0-1160.102.1.el7 3.10.0-1160.105.1.el7 Kpatch-MR: https://gitlab.com/redhat/prdsc/rhel/src/kpatch/rhel-7/-/merge_requests/64 Approved-by: Yannick Cote (@ycote1) Changes since last build: arches: x86_64 ppc64le ip_set_hash_netportnet.o: changed function: hash_netportnet4_uadt ip_set_hash_netportnet.o: changed function: hash_netportnet6_uadt --------------------------- Modifications: - Z-stream sets IP_SET_HASH_WITH_NET0, which kicks off a bunch of preprocessor defined function and data changes, including struct hash_netportnet{4,6}.nets[] array sizing and iteration. Instead of deploying shadow variables to trace new/old instances, just reject CIDR/CIDR2 if they are 0, i.e. remove support for /0 wildcard matching so users get an error when they try to insert a new /0 element. commit 8de5d63e7ee39b62f71af7cd95990d99d300e8ec Author: Phil Sutter Date: Wed Nov 22 19:24:24 2023 +0100 netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro for ip_set_hash_netportnet.c JIRA: https://issues.redhat.com/browse/RHEL-8433 Upstream Status: commit 050d91c03b28ca479df13dfb02bcd2c60dd6a878 CVE: CVE-2023-42753 commit 050d91c03b28ca479df13dfb02bcd2c60dd6a878 Author: Kyle Zeng Date: Tue Sep 5 15:04:09 2023 -0700 netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro for ip_set_hash_netportnet.c The missing IP_SET_HASH_WITH_NET0 macro in ip_set_hash_netportnet can lead to the use of wrong `CIDR_POS(c)` for calculating array offsets, which can lead to integer underflow. As a result, it leads to slab out-of-bound access. This patch adds back the IP_SET_HASH_WITH_NET0 macro to ip_set_hash_netportnet to address the issue. Fixes: 886503f34d63 ("netfilter: ipset: actually allow allowable CIDR 0 in hash:net,port,net") Suggested-by: Jozsef Kadlecsik Signed-off-by: Kyle Zeng Acked-by: Jozsef Kadlecsik Signed-off-by: Florian Westphal Signed-off-by: Phil Sutter Signed-off-by: Joe Lawrence --- net/netfilter/ipset/ip_set_hash_netportnet.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/net/netfilter/ipset/ip_set_hash_netportnet.c b/net/netfilter/ipset/ip_set_hash_netportnet.c index 613e18e720a4..57043081d04c 100644 --- a/net/netfilter/ipset/ip_set_hash_netportnet.c +++ b/net/netfilter/ipset/ip_set_hash_netportnet.c @@ -213,12 +213,16 @@ hash_netportnet4_uadt(struct ip_set *set, struct nlattr *tb[], if (tb[IPSET_ATTR_CIDR]) { e.cidr[0] = nla_get_u8(tb[IPSET_ATTR_CIDR]); + if (e.cidr[0] == 0) + return -IPSET_ERR_INVALID_CIDR; if (e.cidr[0] > HOST_MASK) return -IPSET_ERR_INVALID_CIDR; } if (tb[IPSET_ATTR_CIDR2]) { e.cidr[1] = nla_get_u8(tb[IPSET_ATTR_CIDR2]); + if (e.cidr[1] == 0) + return -IPSET_ERR_INVALID_CIDR; if (e.cidr[1] > HOST_MASK) return -IPSET_ERR_INVALID_CIDR; } @@ -493,12 +497,16 @@ hash_netportnet6_uadt(struct ip_set *set, struct nlattr *tb[], if (tb[IPSET_ATTR_CIDR]) { e.cidr[0] = nla_get_u8(tb[IPSET_ATTR_CIDR]); + if (e.cidr[0] == 0) + return -IPSET_ERR_INVALID_CIDR; if (e.cidr[0] > HOST_MASK) return -IPSET_ERR_INVALID_CIDR; } if (tb[IPSET_ATTR_CIDR2]) { e.cidr[1] = nla_get_u8(tb[IPSET_ATTR_CIDR2]); + if (e.cidr[1] == 0) + return -IPSET_ERR_INVALID_CIDR; if (e.cidr[1] > HOST_MASK) return -IPSET_ERR_INVALID_CIDR; } -- 2.43.0