1 |
From 696e1a48b1a1b01edad542a1ef293665864a4dd0 Mon Sep 17 00:00:00 2001 |
2 |
From: Pablo Neira Ayuso <pablo@netfilter.org> |
3 |
Date: Wed, 11 Jan 2023 17:07:33 +0100 |
4 |
Subject: netfilter: nft_payload: incorrect arithmetics when fetching VLAN header bits |
5 |
|
6 |
From: Pablo Neira Ayuso <pablo@netfilter.org> |
7 |
|
8 |
commit 696e1a48b1a1b01edad542a1ef293665864a4dd0 upstream. |
9 |
|
10 |
If the offset + length goes over the ethernet + vlan header, then the |
11 |
length is adjusted to copy the bytes that are within the boundaries of |
12 |
the vlan_ethhdr scratchpad area. The remaining bytes beyond ethernet + |
13 |
vlan header are copied directly from the skbuff data area. |
14 |
|
15 |
Fix incorrect arithmetic operator: subtract, not add, the size of the |
16 |
vlan header in case of double-tagged packets to adjust the length |
17 |
accordingly to address CVE-2023-0179. |
18 |
|
19 |
Reported-by: Davide Ornaghi <d.ornaghi97@gmail.com> |
20 |
Fixes: f6ae9f120dad ("netfilter: nft_payload: add C-VLAN support") |
21 |
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> |
22 |
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
23 |
--- |
24 |
net/netfilter/nft_payload.c | 2 +- |
25 |
1 file changed, 1 insertion(+), 1 deletion(-) |
26 |
|
27 |
--- a/net/netfilter/nft_payload.c |
28 |
+++ b/net/netfilter/nft_payload.c |
29 |
@@ -62,7 +62,7 @@ nft_payload_copy_vlan(u32 *d, const stru |
30 |
return false; |
31 |
|
32 |
if (offset + len > VLAN_ETH_HLEN + vlan_hlen) |
33 |
- ethlen -= offset + len - VLAN_ETH_HLEN + vlan_hlen; |
34 |
+ ethlen -= offset + len - VLAN_ETH_HLEN - vlan_hlen; |
35 |
|
36 |
memcpy(dst_u8, vlanh + offset - vlan_hlen, ethlen); |
37 |
|