Description
In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_fib: reject fib expression on the netdev egress hook A fib expression in a netdev egress base chain dereferences nft_in(pkt), NULL on the transmit path, causing a NULL pointer dereference at eval. nft_fib_validate() masks the hook with NF_INET_* values, but netdev hook numbers are a separate enum that aliases them (NF_NETDEV_EGRESS == NF_INET_LOCAL_IN), so an egress chain passes validation and then faults. Add nft_fib_netdev_validate() that limits each result/flag to the netdev hook where the device it reads exists: the input-device cases (OIF, OIFNAME, ADDRTYPE with F_IIF) to ingress, the output-device case (ADDRTYPE with F_OIF) to egress, ADDRTYPE with no device flag to both. Also restrict nft_fib_validate() to NFPROTO_IPV4/IPV6/INET so its NF_INET_* masks are not applied to another family's hooks.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
42df6e1d221dddc0f2acf2be37e68d553ad65f96 to < 1258a6da042c0c283dcf5c581acb318db29c760aaffected42df6e1d221dddc0f2acf2be37e68d553ad65f96 to < 4fee43759b489559a491f7c95f9bfa7a1d0c7a10affected42df6e1d221dddc0f2acf2be37e68d553ad65f96 to < 568931f26af4727a51e8521f72efbc78d3b82410affected42df6e1d221dddc0f2acf2be37e68d553ad65f96 to < d01c913febead04a01a5f3a6374d1f45504dc523affected42df6e1d221dddc0f2acf2be37e68d553ad65f96 to < f68305267ebda7e839b5e8f77e8d77535a3d5a0faffected42df6e1d221dddc0f2acf2be37e68d553ad65f96 to < d07955dd34ecae17d35d8c7d0a273a3fba653a8caffected
Linux Linux
Default version status: affected
5.16affected0 to < 5.16unaffected6.1.191 to ≤ 6.1.*unaffected6.6.148 to ≤ 6.6.*unaffected6.12.101 to ≤ 6.12.*unaffected6.18.42 to ≤ 6.18.*unaffected7.1.5 to ≤ 7.1.*unaffected7.2 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/1258a6da042c0c283dcf5c581acb318db29c760a ↗
- https://git.kernel.org/stable/c/4fee43759b489559a491f7c95f9bfa7a1d0c7a10 ↗
- https://git.kernel.org/stable/c/568931f26af4727a51e8521f72efbc78d3b82410 ↗
- https://git.kernel.org/stable/c/d01c913febead04a01a5f3a6374d1f45504dc523 ↗
- https://git.kernel.org/stable/c/f68305267ebda7e839b5e8f77e8d77535a3d5a0f ↗
- https://git.kernel.org/stable/c/d07955dd34ecae17d35d8c7d0a273a3fba653a8c ↗