[PATCH OLK-5.10 0/2] Fix CVE-2026-98490 for OLK-5.10
*** BLURB HERE *** Ilya Maximets (2): net: openvswitch: conntrack: avoid modifying shared unconfirmed ct entry net: openvswitch: conntrack: fix helper UAF due to extensions realloc include/net/netfilter/nf_conntrack.h | 5 ++++ net/openvswitch/conntrack.c | 34 ++++++++++++++++++++++------ 2 files changed, 32 insertions(+), 7 deletions(-) -- 2.25.1
From: Ilya Maximets <i.maximets@ovn.org> stable inclusion from stable-v5.10.271 commit e0fa5ea434b7e8467ef3adc64e3858b1ca2a642d category: bugfix bugzilla: 189268 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=... -------------------------------- commit 26b2bd70d22457556e2fa01cbf1192cb1a94d619 upstream. In a case where skb with an unconfirmed ct entry gets cloned, we may end up committing both but with different sets of extensions. The series of events: 1. The first clone wants to commit and runs the helpers wiring up the extension pointer into the expectation list. 2. Then it looses the confirmation keeping the entry unconfirmed. 3. Second clone now wants to commit labels and adds the new extension for that breaking the pointer in the expectation list causing UAF on the destruction path later. While this is possible to trigger, there should be no practical network pipeline where committing both clones without modifications into the same zone is needed. So, let's just reset the entry in case for some reason we got an skb with a shared one during commit. This doesn't affect any known use cases, but avoids any potential problems with sharing and modification of the unconfirmed ct entry. The fixes tag points to the introduction of helpers, since that's the main UAF trigger for the sharing. Fixes: cae3a2627520 ("openvswitch: Allow attaching helpers to ct action") Cc: stable@vger.kernel.org Reported-by: Axel Mierczuk <axel.mierczuk@1password.com> Signed-off-by: Ilya Maximets <i.maximets@ovn.org> Reviewed-by: Aaron Conole <aconole@redhat.com> Link: https://patch.msgid.link/20260921145655.3167436-2-i.maximets@ovn.org Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Yi Yang <yiyang13@huawei.com> --- include/net/netfilter/nf_conntrack.h | 5 +++++ net/openvswitch/conntrack.c | 12 ++++++++++++ 2 files changed, 17 insertions(+) diff --git a/include/net/netfilter/nf_conntrack.h b/include/net/netfilter/nf_conntrack.h index d4b628317781..b9a1fe423e0b 100644 --- a/include/net/netfilter/nf_conntrack.h +++ b/include/net/netfilter/nf_conntrack.h @@ -170,6 +170,11 @@ static inline void nf_ct_put(struct nf_conn *ct) int nf_ct_l3proto_try_module_get(unsigned short l3proto); void nf_ct_l3proto_module_put(unsigned short l3proto); +static inline bool nf_ct_shared(const struct nf_conn *ct) +{ + return refcount_read(&ct->ct_general.use) > 1; +} + /* load module; enable/disable conntrack in this namespace */ int nf_ct_netns_get(struct net *net, u8 nfproto); void nf_ct_netns_put(struct net *net, u8 nfproto); diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c index 1ff52564affd..c59ef6264576 100644 --- a/net/openvswitch/conntrack.c +++ b/net/openvswitch/conntrack.c @@ -955,6 +955,18 @@ static int __ovs_ct_lookup(struct net *net, struct sw_flow_key *key, enum ip_conntrack_info ctinfo; struct nf_conn *ct; + /* If the ct entry is not confirmed and shared with some other skb, + * e.g., a cloned one, we can't just modify it with the commit as we + * must not modify the extension set. Reset. + */ + if (cached && info->commit) { + ct = nf_ct_get(skb, &ctinfo); + if (ct && !nf_ct_is_confirmed(ct) && nf_ct_shared(ct)) { + nf_reset_ct(skb); + cached = false; + } + } + if (!cached) { struct nf_hook_state state = { .hook = NF_INET_PRE_ROUTING, -- 2.25.1
From: Ilya Maximets <i.maximets@ovn.org> mainline inclusion from mainline-v7.3-rc5 commit 1a4151e6be57b098b7a5ebfbde58585e83200cdc category: bugfix bugzilla: 189268 CVE: CVE-2026-98490 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?i... -------------------------------- While calling the helpers, a raw pointer to the extensions area is wired into expectations list: -> nf_ct_helper() -> helper->help() -> nf_ct_expect_related_report() -> nf_ct_expect_insert() -> hlist_add_head_rcu(&exp->lnode, &master_help->expectations) In case the connection is not confirmed yet, more extensions can be added afterwards with *_ext_add() calls reallocating the extension space and leaving the now invalid pointer in the expectations list that is later accessed while removing the expectation. Make sure that helpers are called at the end after all the other extensions are already added. Note that the helper rejection now leaves the mark and labels set, but that's not different from how the NAT was handled before or how the mark and the labels were handled on confirmation failure. And there are no atomicity guarantees provided by the API anyway. Fixes: cae3a2627520 ("openvswitch: Allow attaching helpers to ct action") Cc: stable@vger.kernel.org Reported-by: Axel Mierczuk <axel.mierczuk@1password.com> Signed-off-by: Ilya Maximets <i.maximets@ovn.org> Reviewed-by: Aaron Conole <aconole@redhat.com> Link: https://patch.msgid.link/20260921145655.3167436-4-i.maximets@ovn.org Signed-off-by: Jakub Kicinski <kuba@kernel.org> Conflicts: net/openvswitch/conntrack.c [Conflicts are caused by the following patches not being merged: 5.10 still calls the local ovs_ct_helper() wrapper while upstream uses nf_ct_helper(), and lacks verdict_to_errno(): ca71277f36e0 ("net: move the ct helper function to nf_conntrack_helper for ovs and tc") c7f79f2620b7 ("openvswitch: prepare for stolen verdict coming from conntrack and nat engine") 5.10 keeps add_helper live (its cleanup 5e6c14dd42a1 and the guard 3c1860543fcc are not merged), so the confirmed branch must keep add_helper: 5e6c14dd42a1 ("net: openvswitch: conntrack: remove 'add_helper' dead code")] Signed-off-by: JiangJieHua <jiangjiehua1@huawei.com> Signed-off-by: Yi Yang <yiyang13@huawei.com> --- net/openvswitch/conntrack.c | 22 +++++++++++++++------- 1 file changed, 15 insertions(+), 7 deletions(-) diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c index c59ef6264576..b6919a23ecbf 100644 --- a/net/openvswitch/conntrack.c +++ b/net/openvswitch/conntrack.c @@ -1038,14 +1038,15 @@ static int __ovs_ct_lookup(struct net *net, struct sw_flow_key *key, } } - /* Call the helper only if: - * - nf_conntrack_in() was executed above ("!cached") or a - * helper was just attached ("add_helper") for a confirmed - * connection, or - * - When committing an unconfirmed connection. + /* Call the helper only if nf_conntrack_in() was executed + * above ("!cached") or a helper was just attached ("add_helper") + * for a confirmed connection. + * + * For unconfirmed connections it will be called later during + * commit as we need to have all the other extensions allocated + * before the call. */ - if ((nf_ct_is_confirmed(ct) ? !cached || add_helper : - info->commit) && + if (nf_ct_is_confirmed(ct) && (!cached || add_helper) && ovs_ct_helper(skb, info->family) != NF_ACCEPT) { return -EINVAL; } @@ -1253,6 +1254,13 @@ static int ovs_ct_commit(struct net *net, struct sw_flow_key *key, &info->labels.mask); if (err) return err; + + /* Call the helpers now. We couldn't do this before as + * all the extensions must be allocated before the call. + */ + err = ovs_ct_helper(skb, info->family); + if (err != NF_ACCEPT) + return -EINVAL; } else if (IS_ENABLED(CONFIG_NF_CONNTRACK_LABELS) && labels_nonzero(&info->labels.mask)) { err = ovs_ct_set_labels(ct, key, &info->labels.value, -- 2.25.1
反馈： 您发送到kernel@openeuler.org的补丁/补丁集，已成功转换为PR！ PR链接地址： https://atomgit.com/openeuler/kernel/merge_requests/30433 邮件列表地址：https://mailweb.openeuler.org/archives/list/kernel@openeuler.org/message/TVC... FeedBack: The patch(es) which you have sent to kernel@openeuler.org mailing list has been converted to a pull request successfully! Pull request link: https://atomgit.com/openeuler/kernel/merge_requests/30433 Mailing list address: https://mailweb.openeuler.org/archives/list/kernel@openeuler.org/message/TVC...
participants (2)
-
patchwork bot -
Yi Yang