summaryrefslogtreecommitdiff
path: root/net
diff options
context:
space:
mode:
authorWander Lairson Costa <wander@redhat.com>2023-08-29 01:12:55 +0300
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2023-09-19 13:20:20 +0300
commit5541827d13cf19b905594eaee586527476efaa61 (patch)
tree720a41fbda79050d2f34dc34733db0034350fa19 /net
parenta1b711c370f5269f4e81a07e7542e351c0c4682e (diff)
downloadlinux-5541827d13cf19b905594eaee586527476efaa61.tar.xz
netfilter: xt_sctp: validate the flag_info count
commit e99476497687ef9e850748fe6d232264f30bc8f9 upstream. sctp_mt_check doesn't validate the flag_count field. An attacker can take advantage of that to trigger a OOB read and leak memory information. Add the field validation in the checkentry function. Fixes: 2e4e6a17af35 ("[NETFILTER] x_tables: Abstraction layer for {ip,ip6,arp}_tables") Cc: stable@vger.kernel.org Reported-by: Lucas Leong <wmliang@infosec.exchange> Signed-off-by: Wander Lairson Costa <wander@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'net')
-rw-r--r--net/netfilter/xt_sctp.c2
1 files changed, 2 insertions, 0 deletions
diff --git a/net/netfilter/xt_sctp.c b/net/netfilter/xt_sctp.c
index 680015ba7cb6..d4bf089c9e3f 100644
--- a/net/netfilter/xt_sctp.c
+++ b/net/netfilter/xt_sctp.c
@@ -150,6 +150,8 @@ static int sctp_mt_check(const struct xt_mtchk_param *par)
{
const struct xt_sctp_info *info = par->matchinfo;
+ if (info->flag_count > ARRAY_SIZE(info->flag_info))
+ return -EINVAL;
if (info->flags & ~XT_SCTP_VALID_FLAGS)
return -EINVAL;
if (info->invflags & ~XT_SCTP_VALID_FLAGS)