Catcrafts/milos-linux
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

netfilter: nft_meta_bridge: fix stale stack leak via IIFHWADDR register

Browse source 
NFT_META_BRI_IIFHWADDR declares its destination register with
len = ETH_ALEN (6 bytes), which the register-init tracking rounds up to
two 32-bit registers (8 bytes). nft_meta_bridge_get_eval() then does
memcpy(dest, br_dev->dev_addr, ETH_ALEN), writing only 6 bytes and
leaving the upper 2 bytes of the second register as uninitialised
nft_do_chain() stack. A downstream load of that register span leaks
those stale bytes to userspace.

Zero the second register before the memcpy so the full declared span is
written.

Fixes: cbd2257dc9 ("netfilter: nft_meta_bridge: introduce NFT_META_BRI_IIFHWADDR support")
Cc: stable@vger.kernel.org
Signed-off-by: Davide Ornaghi <d.ornaghi97@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This commit is contained in:
Davide Ornaghi 2026-06-10 12:39:13 +02:00 • committed by Pablo Neira Ayuso
commit c7d573551f
1 changed files with 2 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

2
net/bridge/netfilter/nft_meta_bridge.c
View file

@ -64,6 +64,8 @@ static void nft_meta_bridge_get_eval(const struct nft_expr *expr,
if (!br_dev)
goto err;
/* ETH_ALEN (6) is shorter than the destination register span (8) */
dest[1] = 0;
memcpy(dest, br_dev->dev_addr, ETH_ALEN);
return;
default: