From 1eb755025bb3579bea60d778c58d344ce4a7a5bd Mon Sep 17 00:00:00 2001 From: Florian Westphal Date: Fri, 23 Sep 2016 14:29:57 -0400 Subject: [PATCH] netfilter: x_tables: check for size overflow Orabug: 24690280 CVE: CVE-2016-3134 Ben Hawkes says: integer overflow in xt_alloc_table_info, which on 32-bit systems can lead to small structure allocation and a copy_from_user based heap corruption. Reported-by: Ben Hawkes Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso Signed-off-by: Brian Maly --- net/netfilter/x_tables.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c index 51a459c3c649..bc372f64a724 100644 --- a/net/netfilter/x_tables.c +++ b/net/netfilter/x_tables.c @@ -659,8 +659,12 @@ EXPORT_SYMBOL_GPL(xt_compat_target_to_user); struct xt_table_info *xt_alloc_table_info(unsigned int size) { struct xt_table_info *newinfo; + size_t sz = sizeof(*newinfo) + size; int cpu; + if (sz < sizeof(*newinfo)) + return NULL; + /* Pedantry: prevent them from hitting BUG() in vmalloc.c --RR */ if ((SMP_ALIGN(size) >> PAGE_SHIFT) + 2 > totalram_pages) return NULL; -- 2.50.1