Skip to contentSkip to conversation

netfilter: nf_conntrack_ipv6: Plug sk_buff leak in fragment handling

PATCH In review Phil Oester 3 participants 3 messages Jun 19, 2013 – Jun 20, 2013

Subsystems (2)
Networking netfilter
lore
Share & tools
lore

Phil Oester

author
#0 lore raw

PATCH 1/1 netfilter: nf_conntrack_ipv6: Plug sk_buff leak in fragment handling

In commit 4cdd3408 ("netfilter: nf_conntrack_ipv6: improve fragmentation handling"), an sk_buff leak was introduced when dealing with reassembled packets by grabbing a reference to the original skb instead of the reassembled skb. At this point, the leak only impacted conntracks with an associated helper.

In commit 58a317f1 ("netfilter: ipv6: add IPv6 NAT support"), the bug was expanded to include all reassembled packets with unconfirmed conntracks.

Fix this by grabbing a reference to the proper reassembled skb. This closes netfilter bugzilla #823.

Phil

Signed-off-by Phil Oester <[email protected]>
net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c +1 -1
index 97bcf2b..c9b6a6e 100644
@@ -204,7 +204,7 @@ static unsigned int __ipv6_conntrack_in(struct net *net,
 		if (ct != NULL && !nf_ct_is_untracked(ct)) {
 			help = nfct_help(ct);
 			if ((help && help->helper) || !nf_ct_is_confirmed(ct)) {
-				nf_conntrack_get_reasm(skb);
+				nf_conntrack_get_reasm(reasm);
 				NF_HOOK_THRESH(NFPROTO_IPV6, hooknum, reasm,
 					       (struct net_device *)in,
 					       (struct net_device *)out,
maintainer
#1 lore raw
Quoted 5 lines · Phil Oester

In commit 4cdd3408 ("netfilter: nf_conntrack_ipv6: improve fragmentation handling"), an sk_buff leak was introduced when dealing with reassembled packets by grabbing a reference to the original skb instead of the reassembled skb. At this point, the leak only impacted conntracks with an associated helper.

David, could you please apply this patch directly in case Pablo doesn't apply it first? This fixes a remote DoS, so it better hit -stable ASAP.

Thanks.

[ archive link: http://patchwork.ozlabs.org/patch/252692/ ]

net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c static unsigned int __ipv6_conntrack_in(struct net *net, · line 210

Quoted 13 lines
net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c +1 -1
index 97bcf2b..c9b6a6e 100644
@@ -204,7 +204,7 @@ static unsigned int __ipv6_conntrack_in(struct net *net,
 		if (ct != NULL && !nf_ct_is_untracked(ct)) {
 			help = nfct_help(ct);
 			if ((help && help->helper) || !nf_ct_is_confirmed(ct)) {
-				nf_conntrack_get_reasm(skb);
+				nf_conntrack_get_reasm(reasm);
 				NF_HOOK_THRESH(NFPROTO_IPV6, hooknum, reasm,
 					       (struct net_device *)in,
 					       (struct net_device *)out,

Thanks for fixing it, but personally I would have preferred a short early warning period.

maintainer
#2 lore raw
Quoted 9 lines · Florian Westphal
Quoted 5 lines · Phil Oester

In commit 4cdd3408 ("netfilter: nf_conntrack_ipv6: improve fragmentation handling"), an sk_buff leak was introduced when dealing with reassembled packets by grabbing a reference to the original skb instead of the reassembled skb. At this point, the leak only impacted conntracks with an associated helper.

David, could you please apply this patch directly in case Pablo doesn't apply it first? This fixes a remote DoS, so it better hit -stable ASAP.

I'll take care of it.