| Message ID | 20240701170215.17623-1-bethany.jamison@canonical.com |
|---|---|
| Headers | show |
| Series | CVE-2024-27017 | expand |
On Mon, Jul 01, 2024 at 12:02:12PM -0500, Bethany Jamison wrote: > [Impact] > > netfilter: nft_set_pipapo: walk over current view on netlink dump > > The generation mask can be updated while netlink dump is in progress. > The pipapo set backend walk iterator cannot rely on it to infer what > view of the datastructure is to be used. Add notation to specify if user > wants to read/update the set. > > Based on patch from Florian Westphal. > > [Fix] > > Noble: pending > Jammy: Clean cherry-pick for prereq commit, Backport fix commit for > context conflict with neighboring function that shouldn't > impact this cve, fix applied as given, (v2) added additional fix > commit with a clean cherry-pick > Focal: not affected > Bionic: not affected > Xenial: not affected > Trusty: not affected > > [Test Case] > > Compile and boot tested > > [Where problems could occur] > > This fix affects those who use the netfilter framework, an issue with > this fix would be visible to the user via unexpected system behavior. > > v2: added follow up fix commit found by Manuel > efefd4f00c96 netfilter: nf_tables: missing iterator type in lookup walk > > Florian Westphal (1): > netfilter: nft_set_pipapo: constify lookup fn args where possible > > Pablo Neira Ayuso (2): > netfilter: nft_set_pipapo: walk over current view on netlink dump > netfilter: nf_tables: missing iterator type in lookup walk > > include/net/netfilter/nf_tables.h | 13 +++++++ > net/netfilter/nf_tables_api.c | 6 +++ > net/netfilter/nft_lookup.c | 1 + > net/netfilter/nft_set_pipapo.c | 24 +++++++----- > net/netfilter/nft_set_pipapo.h | 6 +-- > net/netfilter/nft_set_pipapo_avx2.c | 59 +++++++++++++++++------------ > 6 files changed, 72 insertions(+), 37 deletions(-) > > -- > 2.34.1 > > > -- > kernel-team mailing list > kernel-team@lists.ubuntu.com > https://lists.ubuntu.com/mailman/listinfo/kernel-team Acked-by: Manuel Diewald <manuel.diewald@canonical.com>
On 1.07.2024 19:02, Bethany Jamison wrote: > [Impact] > > netfilter: nft_set_pipapo: walk over current view on netlink dump > > The generation mask can be updated while netlink dump is in progress. > The pipapo set backend walk iterator cannot rely on it to infer what > view of the datastructure is to be used. Add notation to specify if user > wants to read/update the set. > > Based on patch from Florian Westphal. > > [Fix] > > Noble: pending > Jammy: Clean cherry-pick for prereq commit, Backport fix commit for > context conflict with neighboring function that shouldn't > impact this cve, fix applied as given, (v2) added additional fix > commit with a clean cherry-pick > Focal: not affected > Bionic: not affected > Xenial: not affected > Trusty: not affected > > [Test Case] > > Compile and boot tested > > [Where problems could occur] > > This fix affects those who use the netfilter framework, an issue with > this fix would be visible to the user via unexpected system behavior. > > v2: added follow up fix commit found by Manuel > efefd4f00c96 netfilter: nf_tables: missing iterator type in lookup walk > > Florian Westphal (1): > netfilter: nft_set_pipapo: constify lookup fn args where possible > > Pablo Neira Ayuso (2): > netfilter: nft_set_pipapo: walk over current view on netlink dump > netfilter: nf_tables: missing iterator type in lookup walk > > include/net/netfilter/nf_tables.h | 13 +++++++ > net/netfilter/nf_tables_api.c | 6 +++ > net/netfilter/nft_lookup.c | 1 + > net/netfilter/nft_set_pipapo.c | 24 +++++++----- > net/netfilter/nft_set_pipapo.h | 6 +-- > net/netfilter/nft_set_pipapo_avx2.c | 59 +++++++++++++++++------------ > 6 files changed, 72 insertions(+), 37 deletions(-) > Acked-by: Kuba Pawlak <kuba.pawlak@canonical.com>
On 01.07.24 19:02, Bethany Jamison wrote: > [Impact] > > netfilter: nft_set_pipapo: walk over current view on netlink dump > > The generation mask can be updated while netlink dump is in progress. > The pipapo set backend walk iterator cannot rely on it to infer what > view of the datastructure is to be used. Add notation to specify if user > wants to read/update the set. > > Based on patch from Florian Westphal. > > [Fix] > > Noble: pending > Jammy: Clean cherry-pick for prereq commit, Backport fix commit for > context conflict with neighboring function that shouldn't > impact this cve, fix applied as given, (v2) added additional fix > commit with a clean cherry-pick > Focal: not affected > Bionic: not affected > Xenial: not affected > Trusty: not affected > > [Test Case] > > Compile and boot tested > > [Where problems could occur] > > This fix affects those who use the netfilter framework, an issue with > this fix would be visible to the user via unexpected system behavior. > > v2: added follow up fix commit found by Manuel > efefd4f00c96 netfilter: nf_tables: missing iterator type in lookup walk > > Florian Westphal (1): > netfilter: nft_set_pipapo: constify lookup fn args where possible > > Pablo Neira Ayuso (2): > netfilter: nft_set_pipapo: walk over current view on netlink dump > netfilter: nf_tables: missing iterator type in lookup walk > > include/net/netfilter/nf_tables.h | 13 +++++++ > net/netfilter/nf_tables_api.c | 6 +++ > net/netfilter/nft_lookup.c | 1 + > net/netfilter/nft_set_pipapo.c | 24 +++++++----- > net/netfilter/nft_set_pipapo.h | 6 +-- > net/netfilter/nft_set_pipapo_avx2.c | 59 +++++++++++++++++------------ > 6 files changed, 72 insertions(+), 37 deletions(-) > Applied to jammy:linux/master-next. Thanks. -Stefan