netfilter: ebtables: reject blobs that don't provide all entry points
stable inclusion from stable-v4.19.257 commit 358765beb836f5fc2ed26b5df4140d5d3548ac11 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5UQH4 CVE: NA -------------------------------- [ Upstream commit 7997eff82828304b780dc0a39707e1946d6f1ebf ] Harshit Mogalapalli says: In ebt_do_table() function dereferencing 'private->hook_entry[hook]' can lead to NULL pointer dereference. [..] Kernel panic: general protection fault, probably for non-canonical address 0xdffffc0000000005: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f] [..] RIP: 0010:ebt_do_table+0x1dc/0x1ce0 Code: 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 5c 16 00 00 48 b8 00 00 00 00 00 fc ff df 49 8b 6c df 08 48 8d 7d 2c 48 89 fa 48 c1 ea 03 <0f> b6 14 02 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 88 [..] Call Trace: nf_hook_slow+0xb1/0x170 __br_forward+0x289/0x730 maybe_deliver+0x24b/0x380 br_flood+0...
Showing
- include/linux/netfilter_bridge/ebtables.h 0 additions, 4 deletionsinclude/linux/netfilter_bridge/ebtables.h
- net/bridge/netfilter/ebtable_broute.c 0 additions, 8 deletionsnet/bridge/netfilter/ebtable_broute.c
- net/bridge/netfilter/ebtable_filter.c 0 additions, 8 deletionsnet/bridge/netfilter/ebtable_filter.c
- net/bridge/netfilter/ebtable_nat.c 0 additions, 8 deletionsnet/bridge/netfilter/ebtable_nat.c
- net/bridge/netfilter/ebtables.c 1 addition, 7 deletionsnet/bridge/netfilter/ebtables.c
Please register or sign in to comment