Commit 6c483e6d authored May 14, 2024 by Pablo Neira Ayuso Committed by Guo Mengqi May 14, 2024

netfilter: nf_tables: disallow timeout for anonymous sets

mainline inclusion
from mainline-v6.4-rc2
commit e26d3009
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9AK6C
CVE: CVE-2023-52620

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=e26d3009efda338f19016df4175f354a9bd0a4ab



--------------------------------

Never used from userspace, disallow these parameters.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

Conflicts:
	net/netfilter/nf_tables_api.c

Signed-off-by: Zhengchao Shao <shaozhengchao@huawei.com>

parent 1df0d53c

net/netfilter/nf_tables_api.c

+7 −0

Original line number	Diff line number	Diff line
		@@ -4399,6 +4399,9 @@ static int nf_tables_newset(struct net net, struct sock nlsk,
		if (!(flags & NFT_SET_TIMEOUT))
		return -EINVAL;

		if (flags & NFT_SET_ANONYMOUS)
		return -EOPNOTSUPP;

		err = nf_msecs_to_jiffies64(nla[NFTA_SET_TIMEOUT], &timeout);
		if (err)
		return err;
		@@ -4407,6 +4410,10 @@ static int nf_tables_newset(struct net net, struct sock nlsk,
		if (nla[NFTA_SET_GC_INTERVAL] != NULL) {
		if (!(flags & NFT_SET_TIMEOUT))
		return -EINVAL;

		if (flags & NFT_SET_ANONYMOUS)
		return -EOPNOTSUPP;

		gc_int = ntohl(nla_get_be32(nla[NFTA_SET_GC_INTERVAL]));
		}