Ilya Maximets <[email protected]> writes: > In a case where skb with an unconfirmed ct entry gets cloned, we may > end up committing both but with different sets of extensions. > > The series of events: > > 1. The first clone wants to commit and runs the helpers wiring up > the extension pointer into the expectation list. > 2. Then it looses the confirmation keeping the entry unconfirmed. > 3. Second clone now wants to commit labels and adds the new extension > for that breaking the pointer in the expectation list causing > UAF on the destruction path later. > > While this is possible to trigger, there should be no practical > network pipeline where committing both clones without modifications > into the same zone is needed. So, let's just reset the entry in case > for some reason we got an skb with a shared one during commit. This > doesn't affect any known use cases, but avoids any potential problems > with sharing and modification of the unconfirmed ct entry. > > The fixes tag points to the introduction of helpers, since that's the > main UAF trigger for the sharing. > > Fixes: cae3a2627520 ("openvswitch: Allow attaching helpers to ct action") > Cc: [email protected] > Reported-by: Axel Mierczuk <[email protected]> > Signed-off-by: Ilya Maximets <[email protected]> > ---
Reviewed-by: Aaron Conole <[email protected]> _______________________________________________ dev mailing list [email protected] https://mail.openvswitch.org/mailman/listinfo/ovs-dev
