[NETFILTER]: nf_conntrack_tcp: catch invalid state updates over ctnetlink
Invalid states can cause out-of-bound memory accesses of the state table. Also don't insist on having a new state contained in the netlink message. Signed-off-by: Patrick McHardy <kaber@trash.net>
This commit is contained in:
parent
dd13b01036
commit
5f7da4d26d
@ -1129,11 +1129,13 @@ static int nlattr_to_tcp(struct nlattr *cda[], struct nf_conn *ct)
|
||||
if (err < 0)
|
||||
return err;
|
||||
|
||||
if (!tb[CTA_PROTOINFO_TCP_STATE])
|
||||
if (tb[CTA_PROTOINFO_TCP_STATE] &&
|
||||
nla_get_u8(tb[CTA_PROTOINFO_TCP_STATE]) >= TCP_CONNTRACK_MAX)
|
||||
return -EINVAL;
|
||||
|
||||
write_lock_bh(&tcp_lock);
|
||||
ct->proto.tcp.state = nla_get_u8(tb[CTA_PROTOINFO_TCP_STATE]);
|
||||
if (tb[CTA_PROTOINFO_TCP_STATE])
|
||||
ct->proto.tcp.state = nla_get_u8(tb[CTA_PROTOINFO_TCP_STATE]);
|
||||
|
||||
if (tb[CTA_PROTOINFO_TCP_FLAGS_ORIGINAL]) {
|
||||
struct nf_ct_tcp_flags *attr =
|
||||
|
Loading…
Reference in New Issue
Block a user