<html>
<head>
<base href="https://bugzilla.netfilter.org/" />
</head>
<body><table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Bug ID</th>
<td><a class="bz_bug_link
bz_status_NEW "
title="NEW - Stack smash: libnftables does not enforce string length limits for log prefixes"
href="https://bugzilla.netfilter.org/show_bug.cgi?id=1714">1714</a>
</td>
</tr>
<tr>
<th>Summary</th>
<td>Stack smash: libnftables does not enforce string length limits for log prefixes
</td>
</tr>
<tr>
<th>Product</th>
<td>nftables
</td>
</tr>
<tr>
<th>Version</th>
<td>1.0.x
</td>
</tr>
<tr>
<th>Hardware</th>
<td>x86_64
</td>
</tr>
<tr>
<th>OS</th>
<td>RedHat Linux
</td>
</tr>
<tr>
<th>Status</th>
<td>NEW
</td>
</tr>
<tr>
<th>Severity</th>
<td>major
</td>
</tr>
<tr>
<th>Priority</th>
<td>P5
</td>
</tr>
<tr>
<th>Component</th>
<td>nft
</td>
</tr>
<tr>
<th>Assignee</th>
<td>pablo@netfilter.org
</td>
</tr>
<tr>
<th>Reporter</th>
<td>Sam.Clippinger@garmin.com
</td>
</tr></table>
<p>
<div>
<pre>Created <span class=""><a href="attachment.cgi?id=726" name="attach_726" title="Python script to reproduce stack smash">attachment 726</a> <a href="attachment.cgi?id=726&action=edit" title="Python script to reproduce stack smash">[details]</a></span>
Python script to reproduce stack smash
When creating a rule using nft, using a log prefix over 128 bytes overflows a
stack variable and causes a crash. To reproduce from bash:
# Send 140 bytes to trigger the stack protector added by gcc
LOREM_IPSUM="Lorem ipsum dolor sit amet consectetur adipiscing elit sed do
eiusmod tempor incididunt ut labore et dolore magna aliqua Ut enim ad minim ve"
nft add rule ip filter OUTPUT log prefix "\"${LOREM_IPSUM}\""
Output:
*** stack smashing detected ***: terminated
Aborted (core dumped)
# Sending more data bypasses the stack protector
LOREM_IPSUM="Lorem ipsum dolor sit amet consectetur adipiscing elit sed do
eiusmod tempor incididunt ut labore et dolore magna aliqua Ut enim ad minim
veniam quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo
consequat Duis aute irure dolor in reprehenderit in voluptate velit esse cillum
dolore eu fugiat nulla pariatur Excepteur sint occaecat cupidatat non proident
sunt in culpa qui officia deserunt mollit anim id est laborum"
nft add rule ip filter OUTPUT log prefix "\"${LOREM_IPSUM}\""
Output:
Segmentation fault (core dumped)
This crash can be reproduced from Python as well, I've attached a small script
that shows the same behavior as the command line tool.
I am using nftables 1.0.4 on Rocky Linux 9 (RHEL 9 clone).
I am unable to reproduce this crash using nftables 0.9.3 on Rocky Linux 8.
Using that version, the above commands fail with the message "Error: Could not
process rule: Numerical result out of range".
>From what I can see, the log prefix buffer size is defined in
include/linux/netfilter/nf_log.h and used to create stack variables in
src/json.c and src/statement.c. The stack variables are then passed to
expr_to_string() without any indication of the maximum size.
Please let me know if there's anything I can do to assist fixing this bug!
-- Sam</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are watching all bug changes.</li>
</ul>
</body>
</html>