Jeongjun Park 2e151b8ca3 netfilter: ipset: add missing range check in bitmap_ip_uadt ...

commit 35f56c554e upstream.

When tb[IPSET_ATTR_IP_TO] is not present but tb[IPSET_ATTR_CIDR] exists,
the values of ip and ip_to are slightly swapped. Therefore, the range check
for ip should be done later, but this part is missing and it seems that the
vulnerability occurs.

So we should add missing range checks and remove unnecessary range checks.

Cc: <stable@vger.kernel.org>
Reported-by: syzbot+58c872f7790a4d2ac951@syzkaller.appspotmail.com
Fixes: 72205fc68b ("netfilter: ipset: bitmap:ip set type support")
Signed-off-by: Jeongjun Park <aha310510@gmail.com>
Acked-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2024-12-14 19:48:10 +01:00

..

6lowpan

…

9p

9p: fix slab cache name creation for real

2024-11-17 14:59:40 +01:00

802

…

8021q

gro: remove rcu_read_lock/rcu_read_unlock from gro_complete handlers

2024-09-12 11:06:47 +02:00

appletalk

…

atm

…

ax25

…

batman-adv

batman-adv: Don't accept TT entries for out-of-spec VIDs

2024-07-05 09:12:54 +02:00

bluetooth

Bluetooth: Fix type of len in rfcomm_sock_getsockopt{,_old}()

2024-12-14 19:48:09 +01:00

bpf

…

bpfilter

…

bridge

net: bridge: xmit: make sure we have at least eth header len bytes

2024-11-17 14:59:37 +01:00

caif

…

can

can: bcm: Clear bo->bcm_proc_read after remove_proc_entry().

2024-10-17 15:07:41 +02:00

ceph

libceph: fix race between delayed_work() and ceph_monc_stop()

2024-07-18 13:05:49 +02:00

core

bpf, sockmap: Fix sk_msg_reset_curr

2024-12-14 19:47:55 +01:00

dcb

…

dccp

…

decnet

…

dns_resolver

…

dsa

…

ethernet

gro: remove rcu_read_lock/rcu_read_unlock from gro_complete handlers

2024-09-12 11:06:47 +02:00

ethtool

net: introduce a netdev feature for UDP GRO forwarding

2024-12-14 19:48:05 +01:00

hsr

net: hsr: fix hsr_init_sk() vs network/transport headers.

2024-12-14 19:48:05 +01:00

ieee802154

…

ife

…

ipv4

ipmr: fix tables suspicious RCU usage

2024-12-14 19:48:05 +01:00

ipv6

ipmr: convert /proc handlers to rcu_read_lock()

2024-12-14 19:48:05 +01:00

iucv

s390/iucv: fix receive buffer virtual vs physical address confusion

2024-09-04 13:17:38 +02:00

kcm

kcm: Serialise kcm_sendmsg() for the same socket.

2024-09-04 13:17:40 +02:00

key

…

l2tp

genetlink: hold RCU in genlmsg_mcast()

2024-11-08 16:21:57 +01:00

l3mdev

net: Add l3mdev index to flow struct and avoid oif reset for port devices

2024-10-17 15:08:35 +02:00

lapb

…

llc

…

mac80211

mac80211: fix user-power when emulating chanctx

2024-12-14 19:47:40 +01:00

mac802154

net: mac802154: Fix racy device stats updates by DEV_STATS_INC() and DEV_STATS_ADD()

2024-07-27 10:40:21 +02:00

mpls

…

mptcp

mptcp: handle consistently DSS corruption

2024-10-22 15:39:29 +02:00

ncsi

net/ncsi: Fix the multi thread manner of NCSI driver

2024-07-05 09:12:22 +02:00

netfilter

netfilter: ipset: add missing range check in bitmap_ip_uadt

2024-12-14 19:48:10 +01:00

netlabel

…

netlink

netlink: terminate outstanding dump on socket close

2024-12-14 19:47:37 +01:00

netrom

netrom: Fix a memory leak in nr_heartbeat_expiry()

2024-07-05 09:12:37 +02:00

nfc

…

nsh

…

openvswitch

…

packet

af_packet: Handle outgoing VLAN packets without hardware offloading

2024-08-19 05:40:55 +02:00

phonet

…

psample

…

qrtr

net: qrtr: Update packets cloning when broadcasting

2024-10-17 15:07:58 +02:00

rds

net:rds: Fix possible deadlock in rds_message_put

2024-09-04 13:17:45 +02:00

rfkill

net: rfkill: gpio: Add check for clk_enable()

2024-12-14 19:47:55 +01:00

rose

…

rxrpc

…

sched

net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT

2024-11-08 16:22:01 +01:00

sctp

sctp: properly validate chunk size in sctp_sf_ootb()

2024-11-17 14:59:35 +01:00

smc

net/smc: Fix searching in list of known pnetids in smc_pnet_add_pnetid

2024-11-08 16:21:57 +01:00

strparser

…

sunrpc

net, sunrpc: Remap EPERM in case of connection failure in xs_tcp_setup_socket

2024-09-12 11:06:51 +02:00

switchdev

…

tipc

tipc: guard against string buffer overrun

2024-10-17 15:08:11 +02:00

tls

…

unix

af_unix: Remove put_pid()/put_cred() in copy_peercred().

2024-09-12 11:06:45 +02:00

vmw_vsock

vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans

2024-11-17 14:59:39 +01:00

wimax

…

wireless

genetlink: hold RCU in genlmsg_mcast()

2024-11-08 16:21:57 +01:00

x25

…

xdp

…

xfrm

xfrm: store and rely on direction to construct offload flags

2024-12-14 19:47:51 +01:00

compat.c

…

devres.c

…

Kconfig

…

Makefile

…

socket.c

…

sysctl_net.c

…