Skip to content

Commit

Permalink
netfilter: nfnetlink_acct: validate NFACCT_QUOTA parameter
Browse files Browse the repository at this point in the history
If a quota bit is set in NFACCT_FLAGS but the NFACCT_QUOTA parameter is
missing then a NULL pointer dereference is triggered. CAP_NET_ADMIN is
required to trigger the bug.

Signed-off-by: Phil Turnbull <phil.turnbull@oracle.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
  • Loading branch information
Phil Turnbull authored and Pablo Neira Ayuso committed May 5, 2016
1 parent cec5913 commit eda3fc5
Showing 1 changed file with 2 additions and 0 deletions.
2 changes: 2 additions & 0 deletions net/netfilter/nfnetlink_acct.c
Original file line number Diff line number Diff line change
Expand Up @@ -96,6 +96,8 @@ static int nfnl_acct_new(struct net *net, struct sock *nfnl,
return -EINVAL;
if (flags & NFACCT_F_OVERQUOTA)
return -EINVAL;
if ((flags & NFACCT_F_QUOTA) && !tb[NFACCT_QUOTA])
return -EINVAL;

size += sizeof(u64);
}
Expand Down

0 comments on commit eda3fc5

Please sign in to comment.