netfilter: x_tables: enforce nul-terminated table name from getsockopt GET_ENTRIES

Orabug: 24690280
CVE: CVE-2016-3134

Make sure the table names via getsockopt GET_ENTRIES is nul-terminated
in ebtables and all the x_tables variants and their respective compat
code. Uncovered by KASAN.

Reported-by: Baozeng Ding <sploving1@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
(cherry picked from commit b301f2538759933cf9ff1f7c4f968da72e3f0757)
Signed-off-by: Brian Maly <brian.maly@oracle.com>

diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
index 91180a7fc94376ea3ca7eecf274c03c3bc919590..62724b1bd4450c58ad0944a719fac94dceb8f5e8 100644 (file)
--- a/net/bridge/netfilter/ebtables.c
+++ b/net/bridge/netfilter/ebtables.c
@@ -1511,6 +1511,8 @@ static int do_ebt_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
        if (copy_from_user(&tmp, user, sizeof(tmp)))
                return -EFAULT;
 
+       tmp.name[sizeof(tmp.name) - 1] = '\0';
+
        t = find_table_lock(net, tmp.name, &ret, &ebt_mutex);
        if (!t)
                return ret;
@@ -2326,6 +2328,8 @@ static int compat_do_ebt_get_ctl(struct sock *sk, int cmd,
        if (copy_from_user(&tmp, user, sizeof(tmp)))
                return -EFAULT;
 
+       tmp.name[sizeof(tmp.name) - 1] = '\0';
+
        t = find_table_lock(net, tmp.name, &ret, &ebt_mutex);
        if (!t)
                return ret;

diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c
index 2953ee9e5fa06cfb599805b8834aa84dc4a45db1..32fd03a7bf30926c975dcae4d6e06aca5fdd65f8 100644 (file)
--- a/net/ipv4/netfilter/arp_tables.c
+++ b/net/ipv4/netfilter/arp_tables.c
@@ -966,6 +966,7 @@ static int get_entries(struct net *net, struct arpt_get_entries __user *uptr,
                         sizeof(struct arpt_get_entries) + get.size);
                return -EINVAL;
        }
+       get.name[sizeof(get.name) - 1] = '\0';
 
        t = xt_find_table_lock(net, NFPROTO_ARP, get.name);
        if (!IS_ERR_OR_NULL(t)) {
@@ -1545,6 +1546,7 @@ static int compat_get_entries(struct net *net,
                         *len, sizeof(get) + get.size);
                return -EINVAL;
        }
+       get.name[sizeof(get.name) - 1] = '\0';
 
        xt_compat_lock(NFPROTO_ARP);
        t = xt_find_table_lock(net, NFPROTO_ARP, get.name);

diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
index 1dcd8d18d1a6f49095b5339532f078f03d25df00..a9c33350ba3c8afe12809c2882c346099e8b0ade 100644 (file)
--- a/net/ipv4/netfilter/ip_tables.c
+++ b/net/ipv4/netfilter/ip_tables.c
@@ -1155,6 +1155,7 @@ get_entries(struct net *net, struct ipt_get_entries __user *uptr,
                         *len, sizeof(get) + get.size);
                return -EINVAL;
        }
+       get.name[sizeof(get.name) - 1] = '\0';
 
        t = xt_find_table_lock(net, AF_INET, get.name);
        if (!IS_ERR_OR_NULL(t)) {
@@ -1794,6 +1795,7 @@ compat_get_entries(struct net *net, struct compat_ipt_get_entries __user *uptr,
                         *len, sizeof(get) + get.size);
                return -EINVAL;
        }
+       get.name[sizeof(get.name) - 1] = '\0';
 
        xt_compat_lock(AF_INET);
        t = xt_find_table_lock(net, AF_INET, get.name);

diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
index b48c375abf38f03fa77a8d113ac99b609319c06c..fec001a14d59f7e50286c1164b0b249b61a36941 100644 (file)
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -1168,6 +1168,7 @@ get_entries(struct net *net, struct ip6t_get_entries __user *uptr,
                         *len, sizeof(get) + get.size);
                return -EINVAL;
        }
+       get.name[sizeof(get.name) - 1] = '\0';
 
        t = xt_find_table_lock(net, AF_INET6, get.name);
        if (!IS_ERR_OR_NULL(t)) {
@@ -1799,6 +1800,7 @@ compat_get_entries(struct net *net, struct compat_ip6t_get_entries __user *uptr,
                         *len, sizeof(get) + get.size);
                return -EINVAL;
        }
+       get.name[sizeof(get.name) - 1] = '\0';
 
        xt_compat_lock(AF_INET6);
        t = xt_find_table_lock(net, AF_INET6, get.name);