Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.debian.kernel > #64692 > unrolled thread
| Started by | Salvatore Bonaccorso <carnil@debian.org> |
|---|---|
| First post | 2019-08-07 22:50 +0200 |
| Last post | 2019-08-19 22:40 +0200 |
| Articles | 3 — 2 participants |
Back to article view | Back to linux.debian.kernel
This discussion starts older than the indexed window; earlier articles aren't shown. The article labeled Started by
below is the oldest one visible, not the original post.
Bug#934168: linux-image-4.19.0-5-amd64: iptables-restore may result in NULL pointer dereference at nf_tables_newrule on startup Salvatore Bonaccorso <carnil@debian.org> - 2019-08-07 22:50 +0200
Processed: Re: Bug#934168: linux-image-4.19.0-5-amd64: iptables-restore may result in NULL pointer dereference at nf_tables_newrule on startup "Debian Bug Tracking System" <owner@bugs.debian.org> - 2019-08-07 22:50 +0200
Bug#934168: linux-image-4.19.0-5-amd64: iptables-restore may result in NULL pointer dereference at nf_tables_newrule on startup Salvatore Bonaccorso <carnil@debian.org> - 2019-08-19 22:40 +0200
| From | Salvatore Bonaccorso <carnil@debian.org> |
|---|---|
| Date | 2019-08-07 22:50 +0200 |
| Subject | Bug#934168: linux-image-4.19.0-5-amd64: iptables-restore may result in NULL pointer dereference at nf_tables_newrule on startup |
| Message-ID | <ysB2F-4ep-3@gated-at.bofh.it> |
Control: forcemerge 931330 934168 hi Elias, On Wed, Aug 07, 2019 at 06:51:12PM +0200, Elias Werberich wrote: > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA512 > > Package: src:linux > Version: 4.19.37-5+deb10u1 > Severity: normal > X-Debbugs-Cc: elias@werberich.de > > > Dear Kernel Maintainer, > > I found a reproducible bug which causes a linux kernel oops if > netfilter-persistence.service tries to load IPv4 firewall rules on > startup by calling iptables-restore with the following content as > input: > > *filter > :INPUT ACCEPT [0:0] > :FORWARD DROP [0:0] > :OUTPUT ACCEPT [0:0] > :MY-ICMP - [0:0] > - -A INPUT -j MY-ICMP > - -A MY-ICMP -p icmp -m icmp --icmp-type 3 -j ACCEPT > - -A MY-ICMP -p icmp -m icmp --icmp-type 11 -j ACCEPT > - -A MY-ICMP -p icmp -m icmp --icmp-type 8 -m limit --limit 4/sec -j ACCEPT > COMMIT > > I was able to create this simple ruleset out of a more complex firewall configuration. > This kernel oops appears on nine out of ten startups/reboots. > If it appears, iptables/nftables are not usable anymore. > For more details, consult kernel log. > > Steps to reproduce the kernel oops: > > # Install a fresh, minimal Debian 10 Buster system. (e.g. new VM) > $ apt update > $ apt install iptables iptables-persistent > # Save IPv4 rules on installation, do not save IPv6 rules. > $ cat << \EOF > /etc/iptables/rules.v4 > *filter > :INPUT ACCEPT [0:0] > :FORWARD DROP [0:0] > :OUTPUT ACCEPT [0:0] > :MY-ICMP - [0:0] > - -A INPUT -j MY-ICMP > - -A MY-ICMP -p icmp -m icmp --icmp-type 3 -j ACCEPT > - -A MY-ICMP -p icmp -m icmp --icmp-type 11 -j ACCEPT > - -A MY-ICMP -p icmp -m icmp --icmp-type 8 -m limit --limit 4/sec -j ACCEPT > COMMIT > EOF > $ reboot > > You may need to reboot a second or third time, if it does not appear > on the first startup. > > I was able to reproduce this on AMD64 using VirtualBox VM and a > cloud server provider. It may cause a broken firewall configuration > which leads to a security issue if you reboot without monitoring. Thanks for the reproducing instructions. This looks the same as the bug reported at https://bugzilla.kernel.org/show_bug.cgi?id=203681 which is #931330. This should be fixed in 5.2.6-1. But might need to check which commit(s) fix the issue and see they are already backported to the 4.19.x stable series as well. Regards, Salvatore
[toc] | [next] | [standalone]
| From | "Debian Bug Tracking System" <owner@bugs.debian.org> |
|---|---|
| Date | 2019-08-07 22:50 +0200 |
| Subject | Processed: Re: Bug#934168: linux-image-4.19.0-5-amd64: iptables-restore may result in NULL pointer dereference at nf_tables_newrule on startup |
| Message-ID | <ysB2F-4ep-15@gated-at.bofh.it> |
| In reply to | #64692 |
Processing control commands: > forcemerge 931330 934168 Bug #931330 [src:linux] BUG: unable to handle kernel NULL pointer dereference at 0000000000000337 Bug #934168 [src:linux] linux-image-4.19.0-5-amd64: iptables-restore may result in NULL pointer dereference at nf_tables_newrule on startup Set Bug forwarded-to-address to 'https://bugzilla.kernel.org/show_bug.cgi?id=203681'. Marked as found in versions linux/4.19.37-5. Added tag(s) upstream. Bug #931330 [src:linux] BUG: unable to handle kernel NULL pointer dereference at 0000000000000337 Marked as found in versions linux/4.19.37-6 and linux/4.19.37-5+deb10u1. Merged 931330 934168 -- 931330: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=931330 934168: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=934168 Debian Bug Tracking System Contact owner@bugs.debian.org with problems
[toc] | [prev] | [next] | [standalone]
| From | Salvatore Bonaccorso <carnil@debian.org> |
|---|---|
| Date | 2019-08-19 22:40 +0200 |
| Message-ID | <ywWBA-1rk-3@gated-at.bofh.it> |
| In reply to | #64692 |
Hi Elias,
On Thu, Aug 08, 2019 at 12:47:12AM +0200, Elias Werberich wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA512
>
> Hi Salvatore,
>
> using the current 5.2.6-1 Debian Kernel fixes this bug.
> I have checked the differences between v4.19 and v5.2 in the upstream kernel
> repository and found the following commit:
>
> Commit 9b1ef3a0e906bb4a37a71ee39c8528270b490243 from Linux Kernel Upstream:
> > From 9b1ef3a0e906bb4a37a71ee39c8528270b490243 Mon Sep 17 00:00:00 2001
> > From: Taehee Yoo <ap420073@gmail.com>
> > Date: Tue, 19 Mar 2019 13:22:41 +0900
> > Subject: [PATCH] netfilter: nf_tables: add missing ->release_ops() in error
> > path of newrule()
> >
> > ->release_ops() callback releases resources and this is used in error path.
> > If nf_tables_newrule() fails after ->select_ops(), it should release
> > resources. but it can not call ->destroy() because that should be called
> > after ->init().
> > At this point, ->release_ops() should be used for releasing resources.
> >
> > Test commands:
> > modprobe -rv xt_tcpudp
> > iptables-nft -I INPUT -m tcp <-- error command
> > lsmod
> >
> > Result:
> > Module Size Used by
> > xt_tcpudp 20480 2 <-- it should be 0
> >
> > Fixes: b8e204006340 ("netfilter: nft_compat: use .release_ops and remove list of extension")
> > Signed-off-by: Taehee Yoo <ap420073@gmail.com>
> > Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
> > ---
> > net/netfilter/nf_tables_api.c | 5 ++++-
> > 1 file changed, 4 insertions(+), 1 deletion(-)
> >
> > diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
> > index 2cfb173cd0b2..4e57d90f8884 100644
> > --- a/net/netfilter/nf_tables_api.c
> > +++ b/net/netfilter/nf_tables_api.c
> > @@ -2693,8 +2693,11 @@ static int nf_tables_newrule(struct net *net, struct sock *nlsk,
> > nf_tables_rule_release(&ctx, rule);
> > err1:
> > for (i = 0; i < n; i++) {
> > - if (info[i].ops != NULL)
> > + if (info[i].ops) {
> > module_put(info[i].ops->type->owner);
> > + if (info[i].ops->type->release_ops)
> > + info[i].ops->type->release_ops(info[i].ops);
> > + }
> > }
> > kvfree(info);
> > return err;
> > --
> > 2.22.0
>
> AFAIK, this is not backported to Debian Linux Kernel for Buster.
> It would be great if anyone can check if this is the correct commit.
This looks right, and the commit will actually be included when we
rebase to 4.19.67 for buster.
If it is possible for you, please try to do the simple patching (cf.
https://kernel-team.pages.debian.net/kernel-handbook/ch-common-tasks.html#s4.2.2)
and confirm it fixes the issue indedd that would be great. Otherwise I
will try to have a look tomorrow.
Regards,
Salvatore
[toc] | [prev] | [standalone]
Back to top | Article view | linux.debian.kernel
csiph-web