Catcrafts/milos-linux
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
milos-linux/net
History
Davide Ornaghi c7d573551f netfilter: nft_meta_bridge: fix stale stack leak via IIFHWADDR register 
NFT_META_BRI_IIFHWADDR declares its destination register with
len = ETH_ALEN (6 bytes), which the register-init tracking rounds up to
two 32-bit registers (8 bytes). nft_meta_bridge_get_eval() then does
memcpy(dest, br_dev->dev_addr, ETH_ALEN), writing only 6 bytes and
leaving the upper 2 bytes of the second register as uninitialised
nft_do_chain() stack. A downstream load of that register span leaks
those stale bytes to userspace.

Zero the second register before the memcpy so the full declared span is
written.

Fixes: cbd2257dc9 ("netfilter: nft_meta_bridge: introduce NFT_META_BRI_IIFHWADDR support")
Cc: stable@vger.kernel.org
Signed-off-by: Davide Ornaghi <d.ornaghi97@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2026-06-10 18:00:32 +02:00
..
6lowpan 6lowpan: fix off-by-one in multicast context address compression 2026-06-01 19:10:16 -07:00
9p 9p/trans_xen: replace simple_strto* with kstrtouint 2026-04-16 02:57:01 +00:00
802 net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr 2026-06-04 08:52:41 -07:00
8021q 8021q: delete cleared egress QoS mappings 2026-04-23 12:13:57 +02:00
appletalk appletalk: aarp: zero-initialize aarp_entry to prevent heap info leak 2026-06-03 18:08:58 -07:00
atm net: atm: fix skb leak in sigd_send() default branch 2026-05-12 18:07:02 -07:00
batman-adv batman-adv: bla: avoid NULL-ptr deref for claim via dropped interface 2026-05-19 10:43:54 +02:00
bluetooth Bluetooth: MGMT: Fix backward compatibility with userspace 2026-06-03 11:24:12 -04:00
bpf
bridge netfilter: nft_meta_bridge: fix stale stack leak via IIFHWADDR register 2026-06-10 18:00:32 +02:00
can
ceph libceph: Fix potential null-ptr-deref in decode_choose_args() 2026-05-12 21:00:59 +02:00
core net: Annotate sk->sk_write_space() for UDP SOCKMAP. 2026-06-02 11:44:43 -07:00
dcb
devlink devlink: Release nested relation on devlink free 2026-06-01 19:54:52 -07:00
dns_resolver
dsa net: dsa: remove redundant netdev_lock_ops() from conduit ethtool ops 2026-04-16 19:10:48 -07:00
ethernet
ethtool ethtool: eeprom: add more safeties to EEPROM Netlink fallback 2026-05-27 17:42:09 -07:00
handshake net/handshake: Drain pending requests at net namespace exit 2026-05-28 13:35:32 +02:00
hsr hsr: Remove WARN_ONCE() in hsr_addr_is_self(). 2026-06-02 12:04:52 -07:00
ieee802154 ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit() 2026-06-04 08:51:32 -07:00
ife
ipv4 netfilter: nft_fib: fix stale stack leak via the OIFNAME register 2026-06-10 18:00:19 +02:00
ipv6 netfilter: nft_fib: fix stale stack leak via the OIFNAME register 2026-06-10 18:00:19 +02:00
iucv net/iucv: fix locking in .getsockopt 2026-05-22 17:40:32 -07:00
kcm
key xfrm: route MIGRATE notifications to caller's netns 2026-05-07 09:31:10 +02:00
l2tp l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl() 2026-06-01 19:40:46 -07:00
l3mdev
lapb
llc llc: Return -EINPROGRESS from llc_ui_connect() 2026-04-23 11:40:39 -07:00
mac80211 wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap 2026-06-02 13:26:33 +02:00
mac802154
mctp net: mctp: test: Use dev_direct_xmit for TX to our test device 2026-04-30 13:36:47 -07:00
mpls
mptcp mptcp: add-addr: always drop other suboptions 2026-06-03 19:04:27 -07:00
ncsi
netfilter netfilter: nft_fib: fix stale stack leak via the OIFNAME register 2026-06-10 18:00:19 +02:00
netlabel
netlink net: netlink: don't set nsid on local notifications 2026-05-22 17:11:09 -07:00
nfc nfc: hci: fix out-of-bounds read in HCP header parsing 2026-05-07 12:42:09 +02:00
nsh
openvswitch openvswitch: vport: fix race between linking and the device notifier 2026-05-18 16:38:45 -07:00
packet net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() 2026-04-22 20:16:34 -07:00
phonet phonet/pep: disable BH around forwarded sk_receive_skb() 2026-05-21 07:38:21 -07:00
psample
psp psp: strip variable-length PSP header in psp_dev_rcv() 2026-05-04 19:25:14 -07:00
qrtr
rds net: rds: clear i_sends on setup unwind 2026-06-02 13:31:27 -07:00
rfkill
rxrpc rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer 2026-05-20 16:36:45 -07:00
sched net/sched: fix pedit partial COW leading to page cache corruption 2026-06-04 08:29:02 -07:00
sctp sctp: purge outqueue on stale COOKIE-ECHO handling 2026-06-04 09:01:25 -07:00
shaper net: shaper: rework the VALID marking (again) 2026-05-20 16:34:20 -07:00
smc net/smc: Do not re-initialize smc hashtables 2026-05-22 17:38:02 -07:00
strparser
sunrpc nfsd-7.1 fixes: 2026-05-26 13:49:13 -07:00
switchdev
tipc Including fixes from Netfilter. 2026-04-23 16:50:42 -07:00
tls tls: Preserve sk_err across recvmsg() when data has been copied 2026-05-14 18:19:44 -07:00
unix af_unix: Fix inq_len update problem in partial read 2026-06-03 18:52:25 -07:00
vmw_vsock vsock/vmci: fix sk_ack_backlog leak on failed handshake 2026-06-04 13:08:02 +02:00
wireless wifi: cfg80211: enforce HE/EHT cap/oper consistency 2026-06-03 13:25:19 +02:00
x25
xdp xsk: cache csum_start/csum_offset to fix TOCTOU in xsk_skb_metadata() 2026-06-03 17:45:42 -07:00
xfrm xfrm: input: hold netns during deferred transport reinjection 2026-05-26 10:35:30 +02:00
compat.c
devres.c
Kconfig net: remove ax25 and amateur radio (hamradio) subsystem 2026-04-23 10:24:02 -07:00
Kconfig.debug
Makefile net: remove ax25 and amateur radio (hamradio) subsystem 2026-04-23 10:24:02 -07:00
socket.c
sysctl_net.c