From b59730ddbcc3095e25abd5c5104b54e6523e273a Mon Sep 17 00:00:00 2001 From: shixuantong Date: Tue, 5 Sep 2023 20:25:21 +0800 Subject: [PATCH] set: Do not leave free'd expr_list elements in place --- ...e-free-d-expr_list-elements-in-place.patch | 69 +++++++++++++++++++ libnftnl.spec | 10 ++- 2 files changed, 78 insertions(+), 1 deletion(-) create mode 100644 backport-set-Do-not-leave-free-d-expr_list-elements-in-place.patch diff --git a/backport-set-Do-not-leave-free-d-expr_list-elements-in-place.patch b/backport-set-Do-not-leave-free-d-expr_list-elements-in-place.patch new file mode 100644 index 0000000..cfa743d --- /dev/null +++ b/backport-set-Do-not-leave-free-d-expr_list-elements-in-place.patch @@ -0,0 +1,69 @@ +From 2d83a7d4f58fbf6eaa9aeace49c78d91a86a3b28 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Wed, 31 May 2023 14:09:09 +0200 +Subject: [PATCH] set: Do not leave free'd expr_list elements in place + +When freeing elements, remove them also to prevent a potential UAF. + +Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1685 +Fixes: 3469f09286cee ("src: add NFTNL_SET_EXPRESSIONS") +Signed-off-by: Phil Sutter +--- + src/set.c | 16 ++++++++++++---- + 1 file changed, 12 insertions(+), 4 deletions(-) + +diff --git a/src/set.c b/src/set.c +index c46f827..719e596 100644 +--- a/src/set.c ++++ b/src/set.c +@@ -54,8 +54,10 @@ void nftnl_set_free(const struct nftnl_set *s) + if (s->flags & (1 << NFTNL_SET_USERDATA)) + xfree(s->user.data); + +- list_for_each_entry_safe(expr, next, &s->expr_list, head) ++ list_for_each_entry_safe(expr, next, &s->expr_list, head) { ++ list_del(&expr->head); + nftnl_expr_free(expr); ++ } + + list_for_each_entry_safe(elem, tmp, &s->element_list, head) { + list_del(&elem->head); +@@ -105,8 +107,10 @@ void nftnl_set_unset(struct nftnl_set *s, uint16_t attr) + break; + case NFTNL_SET_EXPR: + case NFTNL_SET_EXPRESSIONS: +- list_for_each_entry_safe(expr, tmp, &s->expr_list, head) ++ list_for_each_entry_safe(expr, tmp, &s->expr_list, head) { ++ list_del(&expr->head); + nftnl_expr_free(expr); ++ } + break; + default: + return; +@@ -210,8 +214,10 @@ int nftnl_set_set_data(struct nftnl_set *s, uint16_t attr, const void *data, + s->user.len = data_len; + break; + case NFTNL_SET_EXPR: +- list_for_each_entry_safe(expr, tmp, &s->expr_list, head) ++ list_for_each_entry_safe(expr, tmp, &s->expr_list, head) { ++ list_del(&expr->head); + nftnl_expr_free(expr); ++ } + + expr = (void *)data; + list_add(&expr->head, &s->expr_list); +@@ -742,8 +748,10 @@ int nftnl_set_nlmsg_parse(const struct nlmsghdr *nlh, struct nftnl_set *s) + + return 0; + out_set_expr: +- list_for_each_entry_safe(expr, next, &s->expr_list, head) ++ list_for_each_entry_safe(expr, next, &s->expr_list, head) { ++ list_del(&expr->head); + nftnl_expr_free(expr); ++ } + + return -1; + } +-- +2.27.0 + diff --git a/libnftnl.spec b/libnftnl.spec index 2cf36be..8e758fb 100644 --- a/libnftnl.spec +++ b/libnftnl.spec @@ -1,11 +1,13 @@ Name: libnftnl Version: 1.2.6 -Release: 1 +Release: 2 Summary: Library for low-level interaction with nftables Netlink's API over libmnl License: GPLv2+ URL: http://netfilter.org/projects/libnftnl/ Source0: http://netfilter.org/projects/libnftnl/files/%{name}-%{version}.tar.xz +Patch6000: backport-set-Do-not-leave-free-d-expr_list-elements-in-place.patch + BuildRequires: libmnl-devel jansson-devel gcc # replace old libnftables package @@ -51,6 +53,12 @@ make %{?_smp_mflags} check %{_includedir}/libnftnl %changelog +* Tue Sep 05 2023 shixuantong - 1.2.6-2 +- Type:bugfix +- ID:NA +- SUG:NA +- DESC:set: Do not leave free'd expr_list elements in place + * Mon Jul 17 2023 zhangchenglin - 1.2.6-1 - Type:enhancement - ID:NA