netfilter: nf_tables: Reject tables of unsupported family
mainline inclusion from mainline-v5.18-rc1 commit f1082dd3 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I8VPKT CVE: CVE-2023-6040 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f1082dd31fe461d482d69da2a8eccfeb7bf07ac2 --------------------------- An nftables family is merely a hollow container, its family just a number and such not reliant on compile-time options other than nftables support itself. Add an artificial check so attempts at using a family the kernel can't support fail as early as possible. This helps user space detect kernels which lack e.g. NFPROTO_INET. Signed-off-by:Phil Sutter <phil@nwl.cc> Signed-off-by:
Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by:
Liu Jian <liujian56@huawei.com> Conflicts: net/netfilter/nf_tables_api.c
Loading
Please sign in to comment