On Mon, Feb 19, 2018 at 03:01:45AM +0100, Florian Westphal wrote: > ebt_among is special, it has a dynamic match size and is exempt > from the central size checks. > > Therefore it must check that the size of the match structure > provided from userspace is sane by making sure em->match_size > is at least the minimum size of the expected structure. > > The module has such a check, but its only done after accessing > a structure that might be out of bounds. > > tested with: ebtables -A INPUT ... \ > --among-dst fe:fe:fe:fe:fe:fe > --among-dst fe:fe:fe:fe:fe:fe --among-src > fe:fe:fe:fe:ff:f,fe:fe:fe:fe:fe:fb,fe:fe:fe:fe:fc:fd,fe:fe:fe:fe:fe:fd,fe:fe:fe:fe:fe:fe > --among-src > fe:fe:fe:fe:ff:f,fe:fe:fe:fe:fe:fa,fe:fe:fe:fe:fe:fd,fe:fe:fe:fe:fe:fe,fe:fe:fe:fe:fe:fe
Applied, thanks Florian.
