On Thu, Jun 15, 2023 at 05:29:18PM +0200, Florent Revest wrote:
If register_nf_conntrack_bpf() fails (for example, if the .BTF section contains an invalid entry), nf_conntrack_init_start() calls nf_conntrack_helper_fini() as part of its cleanup path and nf_ct_helper_hash gets freed.
Further netfilter modules like netfilter_conntrack_ftp don't check whether nf_conntrack initialized correctly and call nf_conntrack_helpers_register() which accesses the freed nf_ct_helper_hash and causes a uaf.
This patch guards nf_conntrack_helper_register() from accessing freed/uninitialized nf_ct_helper_hash maps and fixes a boot-time use-after-free.
How could this possibly happen?
nf_conntrack_ftp depends on nf_conntrack.
If nf_conntrack fails to load, how can nf_conntrack_ftp be loaded?
Cc: stable@vger.kernel.org Fixes: 12f7a505331e ("netfilter: add user-space connection tracking helper infrastructure") Signed-off-by: Florent Revest revest@chromium.org
net/netfilter/nf_conntrack_helper.c | 4 ++++ 1 file changed, 4 insertions(+)
diff --git a/net/netfilter/nf_conntrack_helper.c b/net/netfilter/nf_conntrack_helper.c index 0c4db2f2ac43..f22691f83853 100644 --- a/net/netfilter/nf_conntrack_helper.c +++ b/net/netfilter/nf_conntrack_helper.c @@ -360,6 +360,9 @@ int nf_conntrack_helper_register(struct nf_conntrack_helper *me) BUG_ON(me->expect_class_max >= NF_CT_MAX_EXPECT_CLASSES); BUG_ON(strlen(me->name) > NF_CT_HELPER_NAME_LEN - 1);
- if (!nf_ct_helper_hash)
return -ENOENT;- if (me->expect_policy->max_expected > NF_CT_EXPECT_MAX_CNT) return -EINVAL;
@@ -515,4 +518,5 @@ int nf_conntrack_helper_init(void) void nf_conntrack_helper_fini(void) { kvfree(nf_ct_helper_hash);
- nf_ct_helper_hash = NULL;
}
2.41.0.162.gfafddb0af9-goog