From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.openvz.org (mail.openvz.org [69.168.225.77]) by lore.virtuozzo.com (Postfix) with ESMTPS id 4A35280E7E for ; Mon, 9 Nov 2026 18:08:00 +0000 (UTC) Received: from mail.openvz.org (localhost [127.0.0.1]) by mail.openvz.org (8.14.4/8.14.4) with ESMTP id 6A9I6gE0002334; Mon, 9 Nov 2026 21:06:43 +0300 DKIM-Filter: OpenDKIM Filter v2.11.0 mail.openvz.org 6A9I6gE0002334 Authentication-Results: mail.openvz.org; dkim=fail reason="signature verification failed" (2048-bit key) header.d=virtuozzo.com header.i=@virtuozzo.com header.b="c3zTO9ZR" Received: from mail-wr1-f69.google.com (mail-wr1-f69.google.com [209.85.221.69]) by mail.openvz.org (8.14.4/8.14.4) with ESMTP id 6A9I6f6l002330 (version=TLSv1/SSLv3 cipher=AES128-GCM-SHA256 bits=128 verify=FAIL) for ; Mon, 9 Nov 2026 21:06:42 +0300 DKIM-Filter: OpenDKIM Filter v2.11.0 mail.openvz.org 6A9I6f6l002330 Received: by mail-wr1-f69.google.com with SMTP id ffacd0b85a97d-49323e268aeso825094f8f.1 for ; Mon, 09 Nov 2026 10:06:41 -0800 (PST) X-Gm-Message-State: APuU4Z9556EWIVdaeaiZuVsitrQ0fwE+/b3GnZ2hycF5Hw/1V5++bBGl l3LVob6U6ov4oJMH4O1sSjOljFuhGeFVYf7qfF9gU/x3FXtPCVc77yomBStX77Ezgcpnh6rLDDA AekO4xRQjyW3nm1PxYL5DmJXOMcUMGUVzMvXUiCDZ9Dj6dhqtUoqPIg== X-Gm-Gg: AYBFou12WxTImALYqvvtEp/rRP/1HywTD4DFVdZRHCggLY43MF2Mz7K0zCXSIoy3cxo 9RnjqYPfBvDRxE5/8fuFtytKQHfdIwMXoX5ElPA8EMrRoNAZUqiL7dKbqM3R8felXGPt+mwOL+/ nJ3Z066+a7cmfPaD+liMRxgsrq8bBRqYi1VbZr92u29Bh9JWf4OiQ5bf0R7ismpvJTF+NNdy0hn pfRX+F5tVIL0fbHOXO105KPBLOaxCG1n3TG8/bAF2gM4pImDk+nUKnbCelWJMc5pWBviySaHMaz pYAn0gtditNYbStfwdU8Acd1RoIuHBU202Tn45ojBjcqglVEW5sutFGszs7gkOyorV4SCkFay3T 3nqqA/3VM7BXWcIprTg== X-Received: by 2002:a05:6000:15dc:b0:498:9a2:f613 with SMTP id ffacd0b85a97d-4982c1da21emr398203f8f.3.1794247601565; Mon, 09 Nov 2026 10:06:41 -0800 (PST) X-Received: by 2002:a05:6000:15dc:b0:498:9a2:f613 with SMTP id ffacd0b85a97d-4982c1da21emr398167f8f.3.1794247600991; Mon, 09 Nov 2026 10:06:40 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1794247600; cv=none; d=google.com; s=arc-20260327; b=Qjow4O+KQPcuvcm+/IfL4xjvalxBFJ8gouk8Gyoh/CJV2eSpL4U2X2qNpJQBTzXo40 h3w84jLdv9NFgCQ3zU5pLp6oXui/r38q0QXaL7FOVnC0jDB2403m1/0gAJd0XJwgDNLf XreU7s9XWX2HyOzlVJOHIELLVmF4hpKfnlp61EDmciDylfPDurkqc+zjXQTm93ZVb7eZ X989zq7DKQ3zXz1DSc1+jECuzFmq8q/LYJFozeuH4OjDLCCyu3FXH6dVivBYxQhgVcZs mL0J3h+acOabUIF71VXIkK5xp5x3+9RYUUq30ZUsKk4rFmt8l5tbP92IgG2whBTR3jlw tdUQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=cc:to:message-id:content-transfer-encoding:mime-version:subject :date:from:dkim-signature; bh=OdJ1NuFHxF6FoT8Avba/slKQePva11T6hJfjespMBEg=; fh=26FXTO6eY/S3gvyMXNKNKTFHQ0lD1bPkQ8wRpe0tMZI=; b=gCAMfWJIEyafBOAZCC/zc96XuM+LCGcWzkaTqiEqDMsbjlyON44DLPCG0FAJKDeg4O kCf3FFCAppeLZ207V2bdGo8NDQMDOenXvh52gy9MJIREZ9FDtcTbgEm0OuO8M4bSgiUK +vitxyA/samznzVTVMr5H0m24ZpIs5q5GfDKh4c4m+dtmIhIIN/tCklOI8vHC4std65L LFoE/kibzAFcIf2g4/PU5e00wcITcWIB1Q+lWr8cik3JAyucJ1o5pmYYiAdSrljYmCoE GkhY1vc/QN25ed+agOyz4TgJadoMOkmqMFjYyN9PYhNMWW4SZsjV5Je2Hl4SVbnFN4Ws j3HQ==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@virtuozzo.com header.s=relay header.b=c3zTO9ZR; spf=pass (google.com: domain of khorenko@virtuozzo.com designates 130.117.225.111 as permitted sender) smtp.mailfrom=khorenko@virtuozzo.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=virtuozzo.com Received: from relay.virtuozzo.com (relay.virtuozzo.com. [130.117.225.111]) by mx.google.com with ESMTPS id ffacd0b85a97d-4983585dc78si305788f8f.113.2026.11.09.10.06.40 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 09 Nov 2026 10:06:40 -0800 (PST) Received-SPF: pass (google.com: domain of khorenko@virtuozzo.com designates 130.117.225.111 as permitted sender) client-ip=130.117.225.111; Authentication-Results: mx.google.com; dkim=pass header.i=@virtuozzo.com header.s=relay header.b=c3zTO9ZR; spf=pass (google.com: domain of khorenko@virtuozzo.com designates 130.117.225.111 as permitted sender) smtp.mailfrom=khorenko@virtuozzo.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=virtuozzo.com DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=virtuozzo.com; s=relay; h=Message-Id:Content-Type:MIME-Version:Subject:Date :From; bh=OdJ1NuFHxF6FoT8Avba/slKQePva11T6hJfjespMBEg=; b=c3zTO9ZRT0YaQrltL32 aC81bsfCzo7LUK6OHC5fW/cpVLkNQRo14uof4hPl/CsFsYcDadCEUs3VY9vc6wWzkOotO0Z2ZQ3ag n29Iuz+sw69PDhzGoxllbwa6a+ZzIUqZxwSkxOX6J6Yym56hyOfJW4ps0rLnUNcTI+y46K+q+naX6 5R1NzRMU3YBKd2dJiECGy74KLOEQUVmEgiWa7Vj6CD5NmsREMcLy4Ls1LqACUQcLQXVA4TSVA9enu EDHC37UnvVZo7cnkj2lTWfaFx8jwi02/ywJB2dd00aSndohQsobCkuTrqezGRcYZOJj3HjCQke2l2 F71fWm5vdWeqSjg==; Received: from ch-demo-asa.virtuozzo.com ([130.117.225.8] helo=f0.sw.ru) by relay.virtuozzo.com with esmtp (Exim 4.96) (envelope-from ) id 1xQThM-00AZvK-0B; Mon, 09 Nov 2026 19:06:32 +0100 From: Konstantin Khorenko Date: Mon, 09 Nov 2026 19:06:29 +0100 MIME-Version: 1.0 Message-Id: <20261109-b4-prep-khorenko-vstor-154185-nf_tables-element-data-v1-1-8fea8fe15f89@virtuozzo.com> X-B4-Tracking: v=1; b=H4sIAKUL8moC/yWNSw7CIBQAr9K8tS8ptR/wKsYYoA+LrdAAEmPTu 4u6nFnMbBApWIpwqjYIlG203hVghwr0JN2N0I6FoambnrFaoGpxDbTiPPlAbvaYY/IBWdcy3qE z1yTVQhFpoQe5hKNMEofekObHRgjBoaRLwdjXb3uG/B7g8pfxqe6k03cI+/4B8SGA0Z0AAAA= X-Change-ID: 20261109-b4-prep-khorenko-vstor-154185-nf_tables-element-data-76fec8329998 To: Konstantin Khorenko X-Mailer: b4 0.16.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=3092; i=khorenko@virtuozzo.com; h=from:subject:message-id; bh=1NHUdh+85CEYtz0q8tc1/bVvK2TW19nxeU64X/2uRU8=; b=owEBbQKS/ZANAwAKAVGWCkf5YVwqAcsmYgBq8guwnAFJVxAoWZ9RkW3h+nQT67nfd/U/KbqB8 JLvlaChU+WJAjMEAAEKAB0WIQRWD23IPcXT0GO9CCxRlgpH+WFcKgUCavILsAAKCRBRlgpH+WFc KpXZD/4kWJ8My4a9sz6RdJ7jfmuSLLufkYj91yc+0TH/3rzOJxPQLZytjTsgVT4b2+zMLS9NZuG rxY8dN6rMP6cyFTHWTWGrI3AVzXBUFRXs25M/Xdwl0J9fjzMAU0ZmLAGTWGMtHKRFOu6fldUWHv lwvJLlfpOg7ZEVPrKMauN0PWWoTV7vRFXDgFsld/O3kyQLAEdkJ3RPnyhOYlpxFLjfDdCYhVLKs EEVz5XiR8DgzDYYt/nCS9U/g4gUSz3Y8lTTZJX8IHmQSdlWUPn0Rl0MK8z/nG3AWAITbXSh6xuH wa0AvkukoTJtkheLf1L7HwXaMv1mD7/YF/PXzPB63HTeKy3x2ENoHK7KhBKG5LkOMMhdQb4ZWE8 I6UUe1VKO09KRhvavqXKw70AlYaa0xK9boAeXNObZG0K6oRKpNCZ8pAPZxXRAWnPk9xJH2Po63V roeBkAJ/yD3PHO9AFtyb5Zglq4oHR5F+SD8ip1Y+4DS9jJewl8N5YrjuiS65a09w1w3i2B12+7H tdOpEimNbeLoJSCdj9jgV936jt2ozJ9Nfhj+QKDUcfrVblGkGclL0+2ErIOej4q5hchkdIjOFSF vjL3SbvqMwPyy3zCDajqZ4cRmejPIcrTAk3hBzlAJ9PEKNxv0++ZW8GAAnMpEujxvrDt7duOPkX 4jQMNANJv4YWCYg== X-Developer-Key: i=khorenko@virtuozzo.com; a=openpgp; fpr=560F6DC83DC5D3D063BD082C51960A47F9615C2A X-OZ-Fwd: true Cc: devel@openvz.org Subject: [Devel] [PATCH vz7] ms/netfilter: nf_tables: stricter validation of element data X-BeenThere: devel@openvz.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: OpenVZ development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: devel-bounces@openvz.org Errors-To: devel-bounces@openvz.org From: Pablo Neira Ayuso Make sure element data type and length do not mismatch the one specified by the set declaration. Fixes: 7d7402642eaf ("netfilter: nf_tables: variable sized set element keys / data") Reported-by: Hugues ANGUELKOV Signed-off-by: Pablo Neira Ayuso (cherry picked from commit 7e6bc1f6cabcd30aba0b11219d8e01b952eacbb6) Backport notes: - the check is done in nft_add_set_elem(), desc is d2 there. 7d7402642eaf from Fixes: is not here, but the old check has a similar hole: it skips the length test for verdict maps. An NFT_DATA_VALUE element shorter than struct nft_verdict gets a data extension of d2.len bytes, and nft_set_elem_init() copies set->dlen bytes into it. nft_setelem_parse_data() came with ms commit fdb9c405e35b ("netfilter: nf_tables: allow up to 64 bytes in the set element data area") in v5.8, so here the element data is still parsed inline in nft_add_set_elem(). dtype is compared with d2.type, the type of the element data, as upstream compares it with desc->type. Comparing it with set->dtype instead would be wrong both ways: - for a value map set->dtype holds the datatype id from userspace, e.g. 7 for ipv4_addr from nft, not NFT_DATA_VALUE, so every element add to such a map fails with -EINVAL; - for a verdict map dtype always equals set->dtype, so an NFT_DATA_VALUE element of sizeof(struct nft_verdict) bytes is still taken as a verdict with a chain pointer from userspace. The closest stable backport, 4.14.y commit acd3e18fbcae ("netfilter: nf_tables: stricter validation of element data"), compares with desc->type as well: https://git.kernel.org/stable/c/acd3e18fbcae6c5f9d79d75455569fc132227162 CVE-2022-34918 https://virtuozzo.atlassian.net/browse/VSTOR-154185 Signed-off-by: Konstantin Khorenko --- CVE-2022-34918 fix for the vz7 kernel. https://virtuozzo.atlassian.net/browse/VSTOR-154185 Assisted-by: LLM --- net/netfilter/nf_tables_api.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index 66137ce5e6482..2b17434b3770e 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -3683,13 +3683,20 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set, } if (nla[NFTA_SET_ELEM_DATA] != NULL) { + u32 dtype; + err = nft_data_init(ctx, &data, sizeof(data), &d2, nla[NFTA_SET_ELEM_DATA]); if (err < 0) goto err2; err = -EINVAL; - if (set->dtype != NFT_DATA_VERDICT && d2.len != set->dlen) + if (set->dtype == NFT_DATA_VERDICT) + dtype = NFT_DATA_VERDICT; + else + dtype = NFT_DATA_VALUE; + + if (dtype != d2.type || d2.len != set->dlen) goto err3; dreg = nft_type_to_reg(set->dtype); --- base-commit: 78c10c447efc7633a8e4260fe7dc33e1cb4bb4d2 change-id: 20261109-b4-prep-khorenko-vstor-154185-nf_tables-element-data-76fec8329998 Best regards, -- Konstantin Khorenko, Virtuozzo Linux Kernel Team _______________________________________________ Devel mailing list Devel@openvz.org https://lists.openvz.org/mailman/listinfo/devel