]> git.proxmox.com Git - mirror_ubuntu-kernels.git/commitdiff
netfilter: nf_reject_ipv4: Fix use-after-free in send_reset
authorTejaswi Tanikella <tejaswit@codeaurora.org>
Mon, 23 Oct 2017 06:16:03 +0000 (11:46 +0530)
committerPablo Neira Ayuso <pablo@netfilter.org>
Wed, 1 Nov 2017 11:15:29 +0000 (12:15 +0100)
niph is not updated after pskb_expand_head changes the skb head. It
still points to the freed data, which is then used to update tot_len and
checksum. This could cause use-after-free poison crash.

Update niph, if ip_route_me_harder does not fail.

This only affects the interaction with REJECT targets and br_netfilter.

Signed-off-by: Tejaswi Tanikella <tejaswit@codeaurora.org>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
net/ipv4/netfilter/nf_reject_ipv4.c

index eeacbdaf7cdf4918b7c556efa92df1da0f9f63ee..5cd06ba3535df62181e9803f0dfd2407b5e06177 100644 (file)
@@ -132,6 +132,8 @@ void nf_send_reset(struct net *net, struct sk_buff *oldskb, int hook)
        if (ip_route_me_harder(net, nskb, RTN_UNSPEC))
                goto free_nskb;
 
+       niph = ip_hdr(nskb);
+
        /* "Never happens" */
        if (nskb->len > dst_mtu(skb_dst(nskb)))
                goto free_nskb;