Taehee Yoo 9beceb54fa netfilter: x_tables: Fix use-after-free in ipt_do_table. ... If verdict is NF_STOLEN in the SYNPROXY target, the skb is consumed. However, ipt_do_table() always tries to get ip header from the skb. So that, KASAN triggers the use-after-free message. We can reproduce this message using below command. # iptables -I INPUT -p tcp -j SYNPROXY --mss 1460 [ 193.542265] BUG: KASAN: use-after-free in ipt_do_table+0x1405/0x1c10 [ ... ] [ 193.578603] Call Trace: [ 193.581590] <IRQ> [ 193.584107] dump_stack+0x68/0xa0 [ 193.588168] print_address_description+0x78/0x290 [ 193.593828] ? ipt_do_table+0x1405/0x1c10 [ 193.598690] kasan_report+0x230/0x340 [ 193.603194] __asan_report_load2_noabort+0x19/0x20 [ 193.608950] ipt_do_table+0x1405/0x1c10 [ 193.613591] ? rcu_read_lock_held+0xae/0xd0 [ 193.618631] ? ip_route_input_rcu+0x27d7/0x4270 [ 193.624348] ? ipt_do_table+0xb68/0x1c10 [ 193.629124] ? do_add_counters+0x620/0x620 [ 193.634234] ? iptable_filter_net_init+0x60/0x60 [ ... ] After this patch, only when verdict is XT_CONTINUE, ipt_do_table() tries to get ip header. Also arpt_do_table() is modified because it has same bug. Signed-off-by: Taehee Yoo <ap420073@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>		2017-07-31 20:24:09 +02:00
..
arp_tables.c	netfilter: x_tables: Fix use-after-free in ipt_do_table.	2017-07-31 20:24:09 +02:00
arpt_mangle.c
arptable_filter.c	netfilter: arp_tables: register table in initns	2016-04-07 11:58:49 +02:00
ip_tables.c	netfilter: x_tables: Fix use-after-free in ipt_do_table.	2017-07-31 20:24:09 +02:00
ipt_ah.c	netfilter: ipv4: whitespace around operators	2015-10-16 19:19:23 +02:00
ipt_CLUSTERIP.c	netfilter: ipt_CLUSTERIP: fix use-after-free of proc entry	2017-07-19 11:53:25 +02:00
ipt_ECN.c	net: Change pseudohdr argument of inet_proto_csum_replace* to be a bool	2015-08-17 21:33:06 -07:00
ipt_MASQUERADE.c	netfilter: nat: add dependencies on conntrack module	2016-12-04 21:16:51 +01:00
ipt_REJECT.c	netfilter: x_tables: move hook state into xt_action_param structure	2016-11-03 10:56:21 +01:00
ipt_rpfilter.c	netfilter: rpfilter: fix incorrect loopback packet judgment	2017-01-16 14:23:01 +01:00
ipt_SYNPROXY.c	networking: make skb_put & friends return void pointers	2017-06-16 11:48:39 -04:00
iptable_filter.c	netfilter: xtables: don't hook tables by default	2016-03-02 20:05:24 +01:00
iptable_mangle.c	netfilter: x_tables: simplify ip{6}table_mangle_hook()	2016-07-01 16:37:02 +02:00
iptable_nat.c	netfilter: xtables: don't hook tables by default	2016-03-02 20:05:24 +01:00
iptable_raw.c	netfilter: xtables: don't hook tables by default	2016-03-02 20:05:24 +01:00
iptable_security.c	netfilter: xtables: don't hook tables by default	2016-03-02 20:05:24 +01:00
Kconfig	netfilter: move socket lookup infrastructure to nf_socket_ipv{4,6}.c	2016-11-01 20:50:31 +01:00
Makefile	netfilter: move socket lookup infrastructure to nf_socket_ipv{4,6}.c	2016-11-01 20:50:31 +01:00
nf_conntrack_l3proto_ipv4.c	netfilter: don't track fragmented packets	2017-03-08 18:02:12 +01:00
nf_conntrack_proto_icmp.c	netfilter: add and use nf_ct_set helper	2017-02-02 14:31:54 +01:00
nf_defrag_ipv4.c	skbuff: add and use skb_nfct helper	2017-02-02 14:31:53 +01:00
nf_dup_ipv4.c	netfilter: kill the fake untracked conntrack objects	2017-04-15 11:47:57 +02:00
nf_log_arp.c	lib/vsprintf.c: remove %Z support	2017-02-27 18:43:47 -08:00
nf_log_ipv4.c	netfilter: allow logging from non-init namespaces	2017-02-02 14:31:58 +01:00
nf_nat_h323.c	netfilter: nf_nat_h323: fix crash in nf_ct_unlink_expect_report()	2014-02-05 17:46:05 +01:00
nf_nat_l3proto_ipv4.c	netfilter: don't attach a nat extension by default	2017-04-26 09:30:22 +02:00
nf_nat_masquerade_ipv4.c	netfilter: conntrack: rename nf_ct_iterate_cleanup	2017-05-29 12:46:08 +02:00
nf_nat_pptp.c	netfilter: pptp: attach nat extension when needed	2017-04-26 09:30:22 +02:00
nf_nat_proto_gre.c	netfilter: gre: Use consistent GRE and PTTP header structure instead of the ones defined by netfilter	2016-09-07 10:36:52 +02:00
nf_nat_proto_icmp.c	net: Change pseudohdr argument of inet_proto_csum_replace* to be a bool	2015-08-17 21:33:06 -07:00
nf_nat_snmp_basic.c	netfilter: snmp: avoid stack size warning	2017-05-01 11:43:58 +02:00
nf_reject_ipv4.c	networking: make skb_put & friends return void pointers	2017-06-16 11:48:39 -04:00
nf_socket_ipv4.c	netfilter: remove nf_ct_is_untracked	2017-04-15 11:51:33 +02:00
nf_tables_arp.c	netfilter: nf_tables: only allow in/output for arp packets	2017-07-17 17:02:44 +02:00
nf_tables_ipv4.c	netfilter: Add the missed return value check of nft_register_chain_type	2016-09-12 19:54:45 +02:00
nft_chain_nat_ipv4.c	netfilter: Pass priv instead of nf_hook_ops to netfilter hooks	2015-09-18 22:00:16 +02:00
nft_chain_route_ipv4.c	netfilter: nft_chain_route: re-route before skb is queued to userspace	2016-09-06 18:02:37 +02:00
nft_dup_ipv4.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2016-11-15 10:54:36 -05:00
nft_fib_ipv4.c	netfilter: Remove exceptional & on function name	2017-04-07 18:24:47 +02:00
nft_masq_ipv4.c	netfilter: nf_tables: fix mismatch in big-endian system	2017-03-13 13:30:28 +01:00
nft_redir_ipv4.c	netfilter: nf_tables: fix mismatch in big-endian system	2017-03-13 13:30:28 +01:00
nft_reject_ipv4.c	netfilter: nf_tables: use hook state from xt_action_param structure	2016-11-03 11:52:34 +01:00