Chenguang ZhaoandGreg Kroah-Hartman 95bda3eac0 netlabel: validate unlabeled address and mask attribute lengths ...

[ Upstream commit 9772589b57 ]

netlbl_unlabel_addrinfo_get() used the address attribute length to
determine whether the attribute data could be read as an IPv4 or IPv6
address, but did not independently validate the corresponding mask
attribute length.  A crafted Generic Netlink request could therefore
provide a valid IPv4/IPv6 address attribute with a shorter mask
attribute, which would later be read as a full struct in_addr or
struct in6_addr.

NLA_BINARY policy lengths are maximum lengths by default, so use
NLA_POLICY_EXACT_LEN() for the unlabeled IPv4/IPv6 address and mask
attributes.  This rejects short attributes during policy validation and
also exposes the exact length requirements through policy introspection.

Fixes: 8cc44579d1 ("NetLabel: Introduce static network labels for unlabeled connections")
Signed-off-by: Chenguang Zhao <zhaochenguang@kylinos.cn>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

2026-06-19 13:37:11 +02:00

..

Kconfig

…

Makefile

…

netlabel_addrlist.c

…

netlabel_addrlist.h

…

netlabel_calipso.c

…

netlabel_calipso.h

…

netlabel_cipso_v4.c

…

netlabel_cipso_v4.h

…

netlabel_domainhash.c

…

netlabel_domainhash.h

…

netlabel_kapi.c

…

netlabel_mgmt.c

…

netlabel_mgmt.h

…

netlabel_unlabeled.c

netlabel: validate unlabeled address and mask attribute lengths

2026-06-19 13:37:11 +02:00

netlabel_unlabeled.h

…

netlabel_user.c

…

netlabel_user.h

…