Description
In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_fib: fix stale stack leak via the OIFNAME register For NFT_FIB_RESULT_OIFNAME the destination register is declared with len = IFNAMSIZ (four 32-bit registers), but on the lookup-fail, RTN_LOCAL and oif-mismatch paths nft_fib{4,6}_eval() only writes one register via "*dest = 0". The remaining three registers are left as whatever was on the stack in nft_do_chain()'s struct nft_regs, and a downstream expression that loads the register span can leak that uninitialised kernel stack to userspace. The NFTA_FIB_F_PRESENT existence check has the same shape: it is only meaningful for NFT_FIB_RESULT_OIF, yet it was accepted for any result type while the eval stores a single byte via nft_reg_store8(), leaving the rest of the declared span stale. Fix both: - replace the bare "*dest = 0" in the eval with nft_fib_store_result(), which strscpy_pad()s the whole IFNAMSIZ for OIFNAME (and is already used on the other early-return path), and - restrict NFTA_FIB_F_PRESENT to NFT_FIB_RESULT_OIF and declare its destination as a single u8, so the marked span matches the one byte the eval writes.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
f6d0cbcf09c506b9b022df8f9d7693a7cec3c732 to < 6744e49fe51bfba26522acc2d0e9703cb41d8e50affectedf6d0cbcf09c506b9b022df8f9d7693a7cec3c732 to < eca18feed38b3377a2ec5d1f22af1170c55d0171affectedf6d0cbcf09c506b9b022df8f9d7693a7cec3c732 to < d19ddef8c327a4773ff81f8e51027d1e0b4cf069affectedf6d0cbcf09c506b9b022df8f9d7693a7cec3c732 to < eb8a8124484dbc3c2b543e207da39bbccb703d31affectedf6d0cbcf09c506b9b022df8f9d7693a7cec3c732 to < 8c84885e9790823828bb8084736ea15769b1ac16affectedf6d0cbcf09c506b9b022df8f9d7693a7cec3c732 to < 84d8f58cf28a0415413f43ba7148f7bacd4c1b6eaffectedf6d0cbcf09c506b9b022df8f9d7693a7cec3c732 to < 3544210609f6d1db282bbdeca639104ef624c393affectedf6d0cbcf09c506b9b022df8f9d7693a7cec3c732 to < ab185e0c4fb82dfba6fb86f8271e06f931d9c64caffected
Linux Linux
Default version status: affected
4.10affected0 to < 4.10unaffected5.10.259 to ≤ 5.10.*unaffected5.15.210 to ≤ 5.15.*unaffected6.1.176 to ≤ 6.1.*unaffected6.6.143 to ≤ 6.6.*unaffected6.12.94 to ≤ 6.12.*unaffected6.18.36 to ≤ 6.18.*unaffected7.0.13 to ≤ 7.0.*unaffected7.1 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/6744e49fe51bfba26522acc2d0e9703cb41d8e50 ↗
- https://git.kernel.org/stable/c/eca18feed38b3377a2ec5d1f22af1170c55d0171 ↗
- https://git.kernel.org/stable/c/d19ddef8c327a4773ff81f8e51027d1e0b4cf069 ↗
- https://git.kernel.org/stable/c/eb8a8124484dbc3c2b543e207da39bbccb703d31 ↗
- https://git.kernel.org/stable/c/8c84885e9790823828bb8084736ea15769b1ac16 ↗
- https://git.kernel.org/stable/c/84d8f58cf28a0415413f43ba7148f7bacd4c1b6e ↗
- https://git.kernel.org/stable/c/3544210609f6d1db282bbdeca639104ef624c393 ↗
- https://git.kernel.org/stable/c/ab185e0c4fb82dfba6fb86f8271e06f931d9c64c ↗
- https://cert-portal.siemens.com/productcert/html/ssa-019113.html ↗
- https://cert-portal.siemens.com/productcert/html/ssa-457936.html ↗