diff options
| author | Florian Westphal <[email protected]> | 2022-07-26 12:42:06 +0200 |
|---|---|---|
| committer | Florian Westphal <[email protected]> | 2022-07-26 21:12:42 +0200 |
| commit | 99a63d36cb3ed5ca3aa6fcb64cffbeaf3b0fb164 (patch) | |
| tree | 3c552bf8a966f236cf0bfb778f4b3a945150b2cc /lib/mpi/mpi-mod.c | |
| parent | 9b134b1694ec8926926ba6b7b80884ea829245a0 (diff) | |
netfilter: nf_queue: do not allow packet truncation below transport header offset
Domingo Dirutigliano and Nicola Guerrera report kernel panic when
sending nf_queue verdict with 1-byte nfta_payload attribute.
The IP/IPv6 stack pulls the IP(v6) header from the packet after the
input hook.
If user truncates the packet below the header size, this skb_pull() will
result in a malformed skb (skb->len < 0).
Fixes: 7af4cc3fa158 ("[NETFILTER]: Add "nfnetlink_queue" netfilter queue handler over nfnetlink")
Reported-by: Domingo Dirutigliano <[email protected]>
Signed-off-by: Florian Westphal <[email protected]>
Reviewed-by: Pablo Neira Ayuso <[email protected]>
Diffstat (limited to 'lib/mpi/mpi-mod.c')
0 files changed, 0 insertions, 0 deletions