linux-stable.git/net/netfilter, branch linux-2.6.16.y

[NETFILTER]: {ip,nf}_conntrack_sctp: fix remotely triggerable NULL ptr dereference (CVE-2007-2876)

2007-07-22T15:31:40+00:00

When creating a new connection by sending an unknown chunk type, we don't
transition to a valid state, causing a NULL pointer dereference in
sctp_packet when accessing sctp_timeouts[SCTP_CONNTRACK_NONE].

Fix by don't creating new conntrack entry if initial state is invalid.

Noticed by Vilmos Nebehaj 

Signed-off-by: Patrick McHardy 
Signed-off-by: Adrian Bunk

[NETFILTER]: tcp conntrack: accept SYN|URG as valid

2007-03-24T20:36:52+00:00

Some stacks apparently send packets with SYN|URG set. Linux accepts
these packets, so TCP conntrack should to.

Pointed out by Martijn Posthuma .

Signed-off-by: Patrick McHardy 
Signed-off-by: Adrian Bunk

[NETFILTER]: nfnetlink_log: fix use after free

2007-03-24T20:36:24+00:00

Paranoia: instance_put() might have freed the inst pointer when we
spin_unlock_bh().

Signed-off-by: Michał Mirosław 
Signed-off-by: Patrick McHardy 
Signed-off-by: Adrian Bunk

[NETFILTER]: nfnetlink_log: fix reference leak

2007-03-24T20:34:37+00:00

Stop reference leaking in nfulnl_log_packet(). If we start a timer we
are already taking another reference.

Signed-off-by: Michał Mirosław 
Signed-off-by: Patrick McHardy 
Signed-off-by: Adrian Bunk

[NETFILTER]: nfnetlink_log: fix possible NULL pointer dereference

2007-03-24T20:33:56+00:00

Eliminate possible NULL pointer dereference in nfulnl_recv_config().

Signed-off-by: Michał Mirosław 
Signed-off-by: Patrick McHardy 
Signed-off-by: Adrian Bunk

[NETFILTER]: nfnetlink_log: fix NULL pointer dereference

2007-03-24T20:32:13+00:00

Fix the nasty NULL dereference on multiple packets per netlink message.

BUG: unable to handle kernel NULL pointer dereference at virtual address 00000004
 printing eip:
f8a4b3bf
*pde = 00000000
Oops: 0002 [#1]
SMP
Modules linked in: nfnetlink_log ipt_ttl ipt_REDIRECT xt_tcpudp iptable_nat nf_nat nf_conntrack
_ipv4 xt_state ipt_ipp2p xt_NFLOG xt_hashlimit ip6_tables iptable_filter xt_multiport xt_mark i
pt_set iptable_raw xt_MARK iptable_mangle ip_tables cls_fw cls_u32 sch_esfq sch_htb ip_set_ipma
p ip_set ipt_ULOG x_tables dm_snapshot dm_mirror loop e1000 parport_pc parport e100 floppy ide_
cd cdrom
CPU:    0
EIP:    0060:[]    Not tainted VLI
EFLAGS: 00010206   (2.6.20 #5)
EIP is at __nfulnl_send+0x24/0x51 [nfnetlink_log]
eax: 00000000   ebx: f2b5cbc0   ecx: c03f5f54   edx: c03f4000
esi: f2b5cbc8   edi: c03f5f54   ebp: f8a4b3ec   esp: c03f5f30
ds: 007b   es: 007b   ss: 0068
Process swapper (pid: 0, ti=c03f4000 task=c03bece0 task.ti=c03f4000)
Stack: f2b5cbc0 f8a4b401 00000100 c0444080 c012af49 00000000 f6f19100 f6f19000
       c1707800 c03f5f54 c03f5f54 00000123 00000021 c03e8d08 c0426380 00000009
       c0126932 00000000 00000046 c03e9980 c03e6000 0047b007 c01269bd 00000000
Call Trace:
 [] nfulnl_timer+0x15/0x25 [nfnetlink_log]
 [] run_timer_softirq+0x10a/0x164
 [] __do_softirq+0x60/0xba
 [] do_softirq+0x31/0x35
 [] do_IRQ+0x62/0x74
 [] common_interrupt+0x23/0x28
 [] default_idle+0x0/0x3f
 [] default_idle+0x2d/0x3f
 [] cpu_idle+0xa0/0xb9
 [] start_kernel+0x1a8/0x1ac
 [] unknown_bootoption+0x0/0x181
 =======================
Code: 5e 5f 5b 5e 5f 5d c3 53 89 c3 8d 40 1c 83 7b 1c 00 74 05 e8 2c ee 6d c7 83 7b 14 00 75 04
 31 c0 eb 34 83 7b 10 01 76 09 8b 43 18 <66> c7 40 04 03 00 8b 53 34 8b 43 14 b9 40 00 00 00 e8
 08 9a 84
EIP: [] __nfulnl_send+0x24/0x51 [nfnetlink_log] SS:ESP 0068:c03f5f30
 <0>Kernel panic - not syncing: Fatal exception in interrupt
 <0>Rebooting in 5 seconds..

Panic no more!

Signed-off-by: Michał Mirosław 
Signed-off-by: Patrick McHardy 
Signed-off-by: Adrian Bunk

[NETFILTER]: nfnetlink_log: fix crash on bridged packet

2007-03-24T20:30:53+00:00

physoutdev is only set on purely bridged packet, when nfnetlink_log is used
in the OUTPUT/FORWARD/POSTROUTING hooks on packets forwarded from or to a
bridge it crashes when trying to dereference skb->nf_bridge->physoutdev.

Reported by Holger Eitzenberger 

Signed-off-by: Patrick McHardy 
Signed-off-by: Adrian Bunk

Fix reference counting (memory leak) problem in __nfulnl_send() and callers related to packet queueing.

2007-03-24T20:27:27+00:00

Signed-off-by: Michał Mirosław 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Adrian Bunk

NETFILTER: xt_connbytes: fix division by zero

2007-03-24T20:26:20+00:00

When the packet counter of a connection is zero a division by zero
occurs in div64_64(). Fix that by using zero as average value, which
is correct as long as the packet counter didn't overflow, at which
point we have lost anyway.

Based on patch from Jonas Berlin ,
with suggestions from KOVACS Krisztian .

Signed-off-by: Patrick McHardy 
Signed-off-by: Adrian Bunk

NETFILTER: ctnetlink: check for status attribute existence on conntrack creation

2007-03-24T20:18:36+00:00

Check that status flags are available in the netlink message received
to create a new conntrack.

Fixes a crash in ctnetlink_create_conntrack when the CTA_STATUS attribute
is not present.

Signed-off-by: Pablo Neira Ayuso 
Signed-off-by: Patrick McHardy 
Signed-off-by: Adrian Bunk