Bug 1877571 (CVE-2020-25211) - CVE-2020-25211 kernel: Local buffer overflow in ctnetlink_parse_tuple_filter in net/netfilter/nf_conntrack_netlink.c
Summary: CVE-2020-25211 kernel: Local buffer overflow in ctnetlink_parse_tuple_filter ...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2020-25211
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1893092 1893093 1893094 1877572 1888293 1888294 1888295 1888296 1888297 1889990 1892657 1892658 1892659 1892660 1892661 1892662 1892663 1892664 1892665 1892666 1892667 1892668 1948475 1948476 1948477 1948478
Blocks: 1877573 1954955
TreeView+ depends on / blocked
 
Reported: 2020-09-09 20:54 UTC by Pedro Sampaio
Modified: 2021-09-06 14:43 UTC (History)
55 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in the Linux kernel. A local attacker, able to inject conntrack netlink configuration, could overflow a local buffer causing crashes or triggering the use of incorrect protocol numbers in ctnetlink_parse_tuple_filter in net/netfilter/nf_conntrack_netlink.c. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Clone Of:
Environment:
Last Closed: 2021-01-04 12:27:39 UTC
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2021:0003 0 None None None 2021-01-04 09:19:48 UTC
Red Hat Product Errata RHSA-2021:0004 0 None None None 2021-01-04 09:08:59 UTC
Red Hat Product Errata RHSA-2021:0184 0 None None None 2021-01-19 10:54:00 UTC
Red Hat Product Errata RHSA-2021:0189 0 None None None 2021-01-19 12:26:15 UTC
Red Hat Product Errata RHSA-2021:0763 0 None None None 2021-03-09 09:34:57 UTC
Red Hat Product Errata RHSA-2021:0765 0 None None None 2021-03-09 11:09:39 UTC
Red Hat Product Errata RHSA-2021:0774 0 None None None 2021-03-09 10:22:38 UTC
Red Hat Product Errata RHSA-2021:0856 0 None None None 2021-03-16 13:50:56 UTC
Red Hat Product Errata RHSA-2021:0857 0 None None None 2021-03-16 13:51:59 UTC
Red Hat Product Errata RHSA-2021:2355 0 None None None 2021-06-09 09:27:24 UTC

Description Pedro Sampaio 2020-09-09 20:54:06 UTC
In the Linux kernel through 5.8.7, local attackers able to inject conntrack netlink configuration could overflow a local buffer, causing crashes or triggering use of incorrect protocol numbers in ctnetlink_parse_tuple_filter in net/netfilter/nf_conntrack_netlink.c.

References:

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=1cc5ef91d2ff94d2bf2de3b3585423e8a1051cb6
https://twitter.com/grsecurity/status/1303646421158109185

Comment 1 Pedro Sampaio 2020-09-09 20:54:46 UTC
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1877572]

Comment 2 Alex 2020-09-14 14:27:16 UTC
The bug didn't exist before 5.8 kernels, because function ctnetlink_parse_tuple_filter(..) added starting with 5.8 to the net/netfilter/nf_conntrack_netlink.c.

All rhel* non-affected as result.

Comment 3 Evgenii Shatokhin 2020-09-16 10:34:17 UTC
> The bug didn't exist before 5.8 kernels, because function ctnetlink_parse_tuple_filter(..) added starting with 5.8 to the net/netfilter/nf_conntrack_netlink.c.

Looks like the affected code is still present in RHEL kernels, in ctnetlink_parse_tuple(). At least, 3.10.0-1127.18.2.el7 has it:

static int
ctnetlink_parse_tuple(const struct nlattr * const cda[],
                      struct nf_conntrack_tuple *tuple,
                      enum ctattr_type type, u_int8_t l3num,
                      struct nf_conntrack_zone *zone)
{
        struct nlattr *tb[CTA_TUPLE_MAX+1];
        int err;

        memset(tuple, 0, sizeof(*tuple));

        err = nla_parse_nested(tb, CTA_TUPLE_MAX, cda[type], tuple_nla_policy);
        if (err < 0)
                return err;

        if (!tb[CTA_TUPLE_IP])
                return -EINVAL;

        tuple->src.l3num = l3num;  // l3num is not validated here at all
        <...>
}


The commit message of the

Comment 4 Evgenii Shatokhin 2020-09-16 10:36:59 UTC
The commit message of the upstream fix also states that the bug happened with the kernel 4.14.180 and crash could be triggered in the kernels up to 5.4 exclusive. No public reproducer though.

Comment 5 Fedora Update System 2020-09-16 14:40:01 UTC
FEDORA-2020-5920a7a0b2 has been pushed to the Fedora 31 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 6 Fedora Update System 2020-09-16 14:44:24 UTC
FEDORA-2020-3c6fedeb83 has been pushed to the Fedora 32 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 7 Product Security DevOps Team 2020-09-21 14:41:02 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2020-25211

Comment 8 Alex 2020-10-14 11:47:37 UTC
In reply to comment #3:
> > The bug didn't exist before 5.8 kernels, because function ctnetlink_parse_tuple_filter(..) added starting with 5.8 to the net/netfilter/nf_conntrack_netlink.c.
> 
> Looks like the affected code is still present in RHEL kernels, in
> ctnetlink_parse_tuple(). At least, 3.10.0-1127.18.2.el7 has it:
> 
> static int
> ctnetlink_parse_tuple(const struct nlattr * const cda[],
> ..

Looking to the original patch, it is for ctnetlink_parse_tuple_filter(..), but not for ctnetlink_parse_tuple(..):

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=1cc5ef91d2ff94d2bf2de3b3585423e8a1051cb6

diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index 832eabecfbddc..d65846aa80591 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -1404,7 +1404,8 @@ ctnetlink_parse_tuple_filter(const struct nlattr * const cda[],
 	if (err < 0)
 		return err;
 
-
+	if (l3num != NFPROTO_IPV4 && l3num != NFPROTO_IPV6)
+		return -EOPNOTSUPP;
 	tuple->src.l3num = l3num;
 
 	if (flags & CTA_FILTER_FLAG(CTA_IP_DST) ||

, but both I can see that ctnetlink_parse_tuple(..) is wrapper around ctnetlink_parse_tuple_filter(..):

static int
ctnetlink_parse_tuple(const struct nlattr * const cda[],
		      struct nf_conntrack_tuple *tuple, u32 type,
		      u_int8_t l3num, struct nf_conntrack_zone *zone)
{
	return ctnetlink_parse_tuple_filter(cda, tuple, type, l3num, zone,
					    CTA_FILTER_FLAG(ALL));
}

, so you are right that need to apply the patch for the older versions too (but to func ctnetlink_parse_tuple(..) instead of ctnetlink_parse_tuple_filter(..)).
Thank you.

Comment 9 Alex 2020-10-14 12:46:53 UTC
Mitigation:

To mitigate this issue, prevent module nf_conntrack_netlink from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.

Comment 15 Alex 2020-10-14 14:14:51 UTC
Acknowledgments:

Name: Will McVicker (Google)

Comment 21 Petr Matousek 2020-10-29 12:26:41 UTC
Statement:

This flaw is rated as having Moderate impact (Red Hat Enterprise Linux 7 and lower)  because of the need to have CAP_NET_ADMIN privileges.

This flaw is rated as having Important (Red Hat Enterprise Linux 8) impact because of the need to have CAP_NET_ADMIN privileges. Red Hat Enterprise Linux 8 enabled unprivileged user/network namespaces by default which can be used to exercise this vulnerability.

Comment 24 errata-xmlrpc 2021-01-04 09:08:54 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2021:0004 https://access.redhat.com/errata/RHSA-2021:0004

Comment 25 errata-xmlrpc 2021-01-04 09:20:19 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2021:0003 https://access.redhat.com/errata/RHSA-2021:0003

Comment 26 Product Security DevOps Team 2021-01-04 12:27:39 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2020-25211

Comment 27 errata-xmlrpc 2021-01-19 10:53:52 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.1 Extended Update Support

Via RHSA-2021:0184 https://access.redhat.com/errata/RHSA-2021:0184

Comment 28 errata-xmlrpc 2021-01-19 12:26:09 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.1 Extended Update Support

Via RHSA-2021:0189 https://access.redhat.com/errata/RHSA-2021:0189

Comment 29 errata-xmlrpc 2021-03-09 09:34:46 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.2 Extended Update Support

Via RHSA-2021:0763 https://access.redhat.com/errata/RHSA-2021:0763

Comment 30 errata-xmlrpc 2021-03-09 10:22:29 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.2 Extended Update Support

Via RHSA-2021:0774 https://access.redhat.com/errata/RHSA-2021:0774

Comment 31 errata-xmlrpc 2021-03-09 11:09:25 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.2 Extended Update Support

Via RHSA-2021:0765 https://access.redhat.com/errata/RHSA-2021:0765

Comment 32 errata-xmlrpc 2021-03-16 13:50:54 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2021:0856 https://access.redhat.com/errata/RHSA-2021:0856

Comment 33 errata-xmlrpc 2021-03-16 13:51:54 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2021:0857 https://access.redhat.com/errata/RHSA-2021:0857

Comment 35 errata-xmlrpc 2021-05-11 12:30:01 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7.7 Extended Update Support

Via RHSA-2021:1531 https://access.redhat.com/errata/RHSA-2021:1531

Comment 36 errata-xmlrpc 2021-06-01 08:43:10 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7.4 Advanced Update Support
  Red Hat Enterprise Linux 7.4 Update Services for SAP Solutions
  Red Hat Enterprise Linux 7.4 Telco Extended Update Support

Via RHSA-2021:2164 https://access.redhat.com/errata/RHSA-2021:2164

Comment 37 errata-xmlrpc 2021-06-09 09:27:15 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7.6 Advanced Update Support
  Red Hat Enterprise Linux 7.6 Update Services for SAP Solutions
  Red Hat Enterprise Linux 7.6 Telco Extended Update Support

Via RHSA-2021:2355 https://access.redhat.com/errata/RHSA-2021:2355


Note You need to log in before you can comment on or make changes to this bug.