Last updated 29 November 2024

Last updated 24 July 2024

Kernel NULL pointer dereference vulnerability was found in netfilter/nfnatredirect.c in nfnatredirectipv4 function introduced by commit 8b13eddfdf04cbfa561725cfc42d6868fe896f56 ("netfilter: refactor NAT redirect IPv4 to use it from nftables").

Vulnerable code:

unsigned int nfnatredirectipv4(struct skbuff skb, ... { ... rcureadlock(); indev = indevgetrcu(skb->dev); if (indev != NULL) { ifa = indev->ifalist; newdst = ifa->ifalocal; <--- } rcureadunlock(); ... }

'ifa' is not checked before access and can be accessed even if it's NULL. Crash might happen when packets that need to be redirected somehow arrive on an interface which hasn't been yet fully configured.

Patch and crash report:

https://lkml.org/lkml/2015/12/2/618

Oss-security reference:

http://seclists.org/oss-sec/2016/q1/223

CVE assignment:

http://seclists.org/oss-sec/2016/q1/226

The skbflowdissect function in net/core/flowdissector.c in the Linux kernel before 4.3 does not ensure that nproto, ipproto, and thoff are initialized, which allows remote attackers to cause a denial of service (system crash) or possibly execute arbitrary code via a single crafted MPLS packet.