netfilter: CVE-2018-1068

netfilter: ebtables: CONFIG_COMPAT: don't trust userland offsets

References:
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=linux-4.1.y&id=1829a59ba6e8fa6467ea4607cf086b5e2d8d6426

Change-Id: If0e3aa0ed5800fcb02573200fba95d8a9c438914
Signed-off-by: Andreas Wellving <andreas.wellving@enea.com>

2 files changed, 67 insertions, 2 deletions

diff --git a/patches/cve/4.1.x.scc b/patches/cve/4.1.x.scc
index 3d8e1ae..f0ed6a8 100644
--- a/patches/cve/4.1.x.scc
+++ b/patches/cve/4.1.x.scc
@@ -35,6 +35,6 @@ patch CVE-2017-7184-xfrm_user-validate-XFRM_MSG_NEWAE-incoming-ESN-size-.patch
 patch CVE-2016-10318-fscrypto-add-authorization-check-for-setting-encrypt.patch
 patch CVE-2016-9793-net-avoid-signed-overflows-for-SO_-SND-RCV-BUFFORCE.patch
 
-
-
+#fixed in 4.1.51
+patch CVE-2018-1068-netfilter-ebtables-CONFIG_COMPAT-don-t-trust-userlan.patch
 
diff --git a/patches/cve/CVE-2018-1068-netfilter-ebtables-CONFIG_COMPAT-don-t-trust-userlan.patch b/patches/cve/CVE-2018-1068-netfilter-ebtables-CONFIG_COMPAT-don-t-trust-userlan.patch
new file mode 100644
index 0000000..28a21de
--- /dev/null
+++ b/patches/cve/CVE-2018-1068-netfilter-ebtables-CONFIG_COMPAT-don-t-trust-userlan.patch
@@ -0,0 +1,65 @@
+From 1829a59ba6e8fa6467ea4607cf086b5e2d8d6426 Mon Sep 17 00:00:00 2001
+From: Florian Westphal <fw@strlen.de>
+Date: Mon, 19 Feb 2018 01:24:15 +0100
+Subject: [PATCH] netfilter: ebtables: CONFIG_COMPAT: don't trust userland
+ offsets
+
+[ Upstream commit b71812168571fa55e44cdd0254471331b9c4c4c6 ]
+
+We need to make sure the offsets are not out of range of the
+total size.
+Also check that they are in ascending order.
+
+The WARN_ON triggered by syzkaller (it sets panic_on_warn) is
+changed to also bail out, no point in continuing parsing.
+
+Briefly tested with simple ruleset of
+-A INPUT --limit 1/s' --log
+plus jump to custom chains using 32bit ebtables binary.
+
+CVE: CVE-2018-1068  
+Upstream-Status: Backport  
+
+Reported-by: <syzbot+845a53d13171abf8bf29@syzkaller.appspotmail.com>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Andreas Wellving <andreas.wellving@enea.com>
+---
+ net/bridge/netfilter/ebtables.c | 13 ++++++++++++-
+ 1 file changed, 12 insertions(+), 1 deletion(-)
+
+diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
+index 91180a7..3069eaf 100644
+--- a/net/bridge/netfilter/ebtables.c
++++ b/net/bridge/netfilter/ebtables.c
+@@ -2019,7 +2019,9 @@ static int ebt_size_mwt(struct compat_ebt_entry_mwt *match32,
+                if (match_kern)
+                        match_kern->match_size = ret;
+ 
+-               WARN_ON(type == EBT_COMPAT_TARGET && size_left);
++               if (WARN_ON(type == EBT_COMPAT_TARGET && size_left))
++                       return -EINVAL;
++
+                match32 = (struct compat_ebt_entry_mwt *) buf;
+        }
+ 
+@@ -2076,6 +2078,15 @@ static int size_entry_mwt(struct ebt_entry *entry, const unsigned char *base,
+         *
+         * offsets are relative to beginning of struct ebt_entry (i.e., 0).
+         */
++       for (i = 0; i < 4 ; ++i) {
++               if (offsets[i] >= *total)
++                       return -EINVAL;
++               if (i == 0)
++                       continue;
++               if (offsets[i-1] > offsets[i])
++                       return -EINVAL;
++       }
++
+        for (i = 0, j = 1 ; j < 4 ; j++, i++) {
+                struct compat_ebt_entry_mwt *match32;
+                unsigned int size;
+-- 
+2.7.4
+