netfilter: nf_tables: do not allow SET_ID to refer to another table

[ 470ee20e069a6d05ae549f7d0ef2bdbcee6a81b2 ]

When doing lookups for sets on the same batch by using its ID, a set from a
different table can be used.

Then, when the table is removed, a reference to the set may be kept after
the set is freed, leading to a potential use-after-free.

When looking for sets by ID, use the table that was used for the lookup by
name, and only return sets belonging to that same table.

This fixes CVE-2022-2586, also reported as ZDI-CAN-17470.

Reported-by: Team Orca of Sea Security (@seasecresponse)
Fixes: 958bee14d071 ("netfilter: nf_tables: use new transaction infrastructure to handle sets")
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h
index 4eb90800fc2e4053eb6cd640ac9dfb448f808383..0d625ff7841ad043acf85012380e9d82c5e10d07 100644 (file)
--- a/include/net/netfilter/nf_tables.h
+++ b/include/net/netfilter/nf_tables.h
@@ -381,6 +381,7 @@ void nft_unregister_set(struct nft_set_type *type);
  *
  *     @list: table set list node
  *     @bindings: list of set bindings
+ *     @table: table this set belongs to
  *     @name: name of the set
  *     @ktype: key type (numeric type defined by userspace, not used in the kernel)
  *     @dtype: data type (verdict or numeric type defined by userspace)
@@ -404,6 +405,7 @@ void nft_unregister_set(struct nft_set_type *type);
 struct nft_set {
        struct list_head                list;
        struct list_head                bindings;
+       struct nft_table                *table;
        char                            *name;
        u32                             ktype;
        u32                             dtype;

diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 86913d53eead9ecd6be6773004c11a4d241c8831..345fa29f34b9ce651f1ab8503615a8d1463fd442 100644 (file)
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -2746,6 +2746,7 @@ static struct nft_set *nf_tables_set_lookup(const struct nft_table *table,
 }
 
 static struct nft_set *nf_tables_set_lookup_byid(const struct net *net,
+                                                const struct nft_table *table,
                                                 const struct nlattr *nla,
                                                 u8 genmask)
 {
@@ -2757,6 +2758,7 @@ static struct nft_set *nf_tables_set_lookup_byid(const struct net *net,
                        struct nft_set *set = nft_trans_set(trans);
 
                        if (id == nft_trans_set_id(trans) &&
+                           set->table == table &&
                            nft_active_genmask(set, genmask))
                                return set;
                }
@@ -2777,7 +2779,7 @@ struct nft_set *nft_set_lookup(const struct net *net,
                if (!nla_set_id)
                        return set;
 
-               set = nf_tables_set_lookup_byid(net, nla_set_id, genmask);
+               set = nf_tables_set_lookup_byid(net, table, nla_set_id, genmask);
        }
        return set;
 }
@@ -3272,6 +3274,7 @@ static int nf_tables_newset(struct net *net, struct sock *nlsk,
        }
 
        INIT_LIST_HEAD(&set->bindings);
+       set->table = table;
        set->ops   = ops;
        set->ktype = ktype;
        set->klen  = desc.klen;
@@ -4209,7 +4212,7 @@ static int nf_tables_newsetelem(struct net *net, struct sock *nlsk,
                                   genmask);
        if (IS_ERR(set)) {
                if (nla[NFTA_SET_ELEM_LIST_SET_ID]) {
-                       set = nf_tables_set_lookup_byid(net,
+                       set = nf_tables_set_lookup_byid(net, ctx.table,
                                        nla[NFTA_SET_ELEM_LIST_SET_ID],
                                        genmask);
                }