nf_conntrack: Infoleak via CTA_ID and CTA_EXPECT_ID

From	Richard Weinberger <richard@nod.at>
Newsgroups	linux.kernel
Subject	nf_conntrack: Infoleak via CTA_ID and CTA_EXPECT_ID
Date	2017-06-30 21:30 +0200
Message-ID	<tY9M6-13z-3@gated-at.bofh.it> (permalink)
Organization	linux.* mail to news gateway

Show all headers | View raw

Hi!

I noticed that nf_conntrack leaks kernel addresses, it uses the memory address
as identifier used for generating conntrack and expect ids..
Since these ids are also visible to unprivileged users via network namespaces
I suggest reverting these commits:

commit 7f85f914721ffcef382a57995182916bd43d8a65
Author: Patrick McHardy <kaber@trash.net>
Date:   Fri Sep 28 14:41:27 2007 -0700

    [NETFILTER]: nf_conntrack: kill unique ID

    Remove the per-conntrack ID, its not necessary anymore for dumping.
    For compatiblity reasons we send the address of the conntrack to
    userspace as ID.

    Signed-off-by: Patrick McHardy <kaber@trash.net>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 3583240249ef354760e04ae49bd7b462a638f40c
Author: Patrick McHardy <kaber@trash.net>
Date:   Fri Sep 28 14:41:50 2007 -0700

    [NETFILTER]: nf_conntrack_expect: kill unique ID

    Similar to the conntrack ID, the per-expectation ID is not needed
    anymore, kill it.

    Signed-off-by: Patrick McHardy <kaber@trash.net>
    Signed-off-by: David S. Miller <davem@davemloft.net>

Thanks,
//richard

Back to linux.kernel | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

nf_conntrack: Infoleak via CTA_ID and CTA_EXPECT_ID Richard Weinberger <richard@nod.at> - 2017-06-30 21:30 +0200
  Re: nf_conntrack: Infoleak via CTA_ID and CTA_EXPECT_ID Florian Westphal <fw@strlen.de> - 2017-06-30 21:40 +0200
    Re: nf_conntrack: Infoleak via CTA_ID and CTA_EXPECT_ID Richard Weinberger <richard@nod.at> - 2017-06-30 21:50 +0200
      Re: nf_conntrack: Infoleak via CTA_ID and CTA_EXPECT_ID Florian Westphal <fw@strlen.de> - 2017-06-30 22:00 +0200
        Re: nf_conntrack: Infoleak via CTA_ID and CTA_EXPECT_ID Richard Weinberger <richard@nod.at> - 2017-06-30 22:30 +0200
          Re: nf_conntrack: Infoleak via CTA_ID and CTA_EXPECT_ID Pablo Neira Ayuso <pablo@netfilter.org> - 2017-07-01 11:50 +0200
          Re: nf_conntrack: Infoleak via CTA_ID and CTA_EXPECT_ID Florian Westphal <fw@strlen.de> - 2017-07-01 12:40 +0200

csiph-web