diff --git a/SOURCES/CVE-2023-42753.patch b/SOURCES/CVE-2023-42753.patch new file mode 100644 index 0000000..2f76752 --- /dev/null +++ b/SOURCES/CVE-2023-42753.patch @@ -0,0 +1,107 @@ +From 6631a62473656c61d7f82cda8ba490c9ba952b96 Mon Sep 17 00:00:00 2001 +From: Joe Lawrence +Date: Mon, 27 Nov 2023 15:50:24 -0500 +Subject: [KPATCH CVE-2023-42753] kpatch fixes for CVE-2023-42753 + +Kernels: +3.10.0-1160.92.1.el7 +3.10.0-1160.95.1.el7 +3.10.0-1160.99.1.el7 +3.10.0-1160.102.1.el7 +3.10.0-1160.105.1.el7 + + +Kpatch-MR: https://gitlab.com/redhat/prdsc/rhel/src/kpatch/rhel-7/-/merge_requests/64 +Approved-by: Yannick Cote (@ycote1) +Changes since last build: +arches: x86_64 ppc64le +ip_set_hash_netportnet.o: changed function: hash_netportnet4_uadt +ip_set_hash_netportnet.o: changed function: hash_netportnet6_uadt +--------------------------- + +Modifications: +- Z-stream sets IP_SET_HASH_WITH_NET0, which kicks off a bunch of + preprocessor defined function and data changes, including struct + hash_netportnet{4,6}.nets[] array sizing and iteration. Instead of + deploying shadow variables to trace new/old instances, just reject + CIDR/CIDR2 if they are 0, i.e. remove support for /0 wildcard matching + so users get an error when they try to insert a new /0 element. + +commit 8de5d63e7ee39b62f71af7cd95990d99d300e8ec +Author: Phil Sutter +Date: Wed Nov 22 19:24:24 2023 +0100 + + netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro for ip_set_hash_netportnet.c + + JIRA: https://issues.redhat.com/browse/RHEL-8433 + Upstream Status: commit 050d91c03b28ca479df13dfb02bcd2c60dd6a878 + CVE: CVE-2023-42753 + + commit 050d91c03b28ca479df13dfb02bcd2c60dd6a878 + Author: Kyle Zeng + Date: Tue Sep 5 15:04:09 2023 -0700 + + netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro for ip_set_hash_netportnet.c + + The missing IP_SET_HASH_WITH_NET0 macro in ip_set_hash_netportnet can + lead to the use of wrong `CIDR_POS(c)` for calculating array offsets, + which can lead to integer underflow. As a result, it leads to slab + out-of-bound access. + This patch adds back the IP_SET_HASH_WITH_NET0 macro to + ip_set_hash_netportnet to address the issue. + + Fixes: 886503f34d63 ("netfilter: ipset: actually allow allowable CIDR 0 in hash:net,port,net") + Suggested-by: Jozsef Kadlecsik + Signed-off-by: Kyle Zeng + Acked-by: Jozsef Kadlecsik + Signed-off-by: Florian Westphal + + Signed-off-by: Phil Sutter + +Signed-off-by: Joe Lawrence +--- + net/netfilter/ipset/ip_set_hash_netportnet.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/net/netfilter/ipset/ip_set_hash_netportnet.c b/net/netfilter/ipset/ip_set_hash_netportnet.c +index 613e18e720a4..57043081d04c 100644 +--- a/net/netfilter/ipset/ip_set_hash_netportnet.c ++++ b/net/netfilter/ipset/ip_set_hash_netportnet.c +@@ -213,12 +213,16 @@ hash_netportnet4_uadt(struct ip_set *set, struct nlattr *tb[], + + if (tb[IPSET_ATTR_CIDR]) { + e.cidr[0] = nla_get_u8(tb[IPSET_ATTR_CIDR]); ++ if (e.cidr[0] == 0) ++ return -IPSET_ERR_INVALID_CIDR; + if (e.cidr[0] > HOST_MASK) + return -IPSET_ERR_INVALID_CIDR; + } + + if (tb[IPSET_ATTR_CIDR2]) { + e.cidr[1] = nla_get_u8(tb[IPSET_ATTR_CIDR2]); ++ if (e.cidr[1] == 0) ++ return -IPSET_ERR_INVALID_CIDR; + if (e.cidr[1] > HOST_MASK) + return -IPSET_ERR_INVALID_CIDR; + } +@@ -493,12 +497,16 @@ hash_netportnet6_uadt(struct ip_set *set, struct nlattr *tb[], + + if (tb[IPSET_ATTR_CIDR]) { + e.cidr[0] = nla_get_u8(tb[IPSET_ATTR_CIDR]); ++ if (e.cidr[0] == 0) ++ return -IPSET_ERR_INVALID_CIDR; + if (e.cidr[0] > HOST_MASK) + return -IPSET_ERR_INVALID_CIDR; + } + + if (tb[IPSET_ATTR_CIDR2]) { + e.cidr[1] = nla_get_u8(tb[IPSET_ATTR_CIDR2]); ++ if (e.cidr[1] == 0) ++ return -IPSET_ERR_INVALID_CIDR; + if (e.cidr[1] > HOST_MASK) + return -IPSET_ERR_INVALID_CIDR; + } +-- +2.43.0 + + diff --git a/SPECS/kpatch-patch.spec b/SPECS/kpatch-patch.spec index a3d4574..547b071 100644 --- a/SPECS/kpatch-patch.spec +++ b/SPECS/kpatch-patch.spec @@ -6,7 +6,7 @@ %define kernel_ver 3.10.0-1160.99.1.el7 %define kpatch_ver 0.9.2 %define rpm_ver 1 -%define rpm_rel 2 +%define rpm_rel 3 %if !%{empty_package} # Patch sources below. DO NOT REMOVE THIS LINE. @@ -28,6 +28,9 @@ Source104: CVE-2023-3776.patch # # https://issues.redhat.com/browse/RHEL-9016 Source105: CVE-2023-4128.patch +# +# https://issues.redhat.com/browse/RHEL-8456 +Source106: CVE-2023-42753.patch # End of patch sources. DO NOT REMOVE THIS LINE. %endif @@ -162,6 +165,9 @@ It is only a method to subscribe to the kpatch stream for kernel-%{kernel_ver}. %endif %changelog +* Fri Jan 05 2024 Yannick Cote [1-3.el7] +- kernel: netfilter: potential slab-out-of-bound access due to integer underflow [RHEL-8456] {CVE-2023-42753} + * Mon Nov 13 2023 Yannick Cote [1-2.el7] - kernel: net/sched: Use-after-free vulnerabilities in the net/sched classifiers: cls_fw, cls_u32 and cls_route [RHEL-9016] {CVE-2023-4128} - kernel: net/sched: cls_fw component can be exploited as result of failure in tcf_change_indev function [RHEL-9208] {CVE-2023-3776}