netfilter: ipset: add missing range check in bitmap_ip_uadt

[jainanmol84]

• Commit Message Requirements
• Built against Vault/LTS Environment
• kABI Check Passed, where Valid (Pre 9.4 RT does not have kABI stability)
• Boot Test
• Kernel SelfTest results
• Additional Tests as determined relevant

Commit message

jira VULN-46556
cve CVE-2024-53141
commit-author Jeongjun Park <[email protected]>
commit 35f56c554eb1b56b77b3cf197a6b00922d49033d

When tb[IPSET_ATTR_IP_TO] is not present but tb[IPSET_ATTR_CIDR] exists, the values of ip and ip_to are slightly swapped. Therefore, the range check for ip should be done later, but this part is missing and it seems that the vulnerability occurs.

So we should add missing range checks and remove unnecessary range checks.

	Cc: <[email protected]>
	Reported-by: [email protected]
Fixes: 72205fc68bd1 ("netfilter: ipset: bitmap:ip set type support")
	Signed-off-by: Jeongjun Park <[email protected]>
	Acked-by: Jozsef Kadlecsik <[email protected]>
	Signed-off-by: Pablo Neira Ayuso <[email protected]>
(cherry picked from commit 35f56c554eb1b56b77b3cf197a6b00922d49033d)
	Signed-off-by: Anmol Jain <[email protected]>
	

Kernel build logs

/home/anmol/kernel-src-tree
no .config file found, moving on
[TIMER]{MRPROPER}: 0s
x86_64 architecture detected, copying config
'configs/kernel-x86_64-rhel.config' -> '.config'
Setting Local Version for build
CONFIG_LOCALVERSION="-ajain__ciqlts9_2-19029a151"
Making olddefconfig
  HOSTCC  scripts/basic/fixdep
  HOSTCC  scripts/kconfig/conf.o
  HOSTCC  scripts/kconfig/confdata.o
  HOSTCC  scripts/kconfig/expr.o
  LEX     scripts/kconfig/lexer.lex.c
  YACC    scripts/kconfig/parser.tab.[ch]
  HOSTCC  scripts/kconfig/lexer.lex.o
  HOSTCC  scripts/kconfig/menu.o
  HOSTCC  scripts/kconfig/parser.tab.o
  HOSTCC  scripts/kconfig/preprocess.o
  HOSTCC  scripts/kconfig/symbol.o
  HOSTCC  scripts/kconfig/util.o
  HOSTLD  scripts/kconfig/conf
#
# configuration written to .config
#
Starting Build
  SYSHDR  arch/x86/include/generated/uapi/asm/unistd_32.h
  WRAP    arch/x86/include/generated/uapi/asm/bpf_perf_event.h
  WRAP    arch/x86/include/generated/uapi/asm/errno.h
  SYSHDR  arch/x86/include/generated/uapi/asm/unistd_64.h
  [--snip--]
  [TIMER]{MODULES}: 34s
Making Install
sh ./arch/x86/boot/install.sh \
	5.14.0-ajain__ciqlts9_2-19029a151+ arch/x86/boot/bzImage \
	System.map "/boot"
[TIMER]{INSTALL}: 53s
Checking kABI
Checking kABI
kABI check passed
Setting Default Kernel to /boot/vmlinuz-5.14.0-ajain__ciqlts9_2-19f8ab0dc+ and Index to 6
The default is /boot/loader/entries/c0d861f4dcc048a1831709161fca1f03-5.14.0-ajain__ciqlts9_2-19f8ab0dc+.conf with index 6 and kernel /boot/vmlinuz-5.14.0-ajain__ciqlts9_2-19f8ab0dc+
The default is /boot/loader/entries/c0d861f4dcc048a1831709161fca1f03-5.14.0-ajain__ciqlts9_2-19f8ab0dc+.conf with index 6 and kernel /boot/vmlinuz-5.14.0-ajain__ciqlts9_2-19f8ab0dc+
Generating grub configuration file ...
Adding boot menu entry for UEFI Firmware Settings ...
done
Hopefully Grub2.0 took everything ... rebooting after time metrices
[TIMER]{MRPROPER}: 0s
[TIMER]{BUILD}: 3651s
[TIMER]{MODULES}: 34s
[TIMER]{INSTALL}: 53s
[TIMER]{TOTAL} 3744s
Rebooting in 10 seconds

kernel-build.log

Kselftests

kselftest-after.log

kselftest-before.log

grep '^ok ' kselftest-before.log | wc -l && grep '^ok ' kselftest-after.log | wc -l
316
315

grep '^not ok ' kselftest-before.log | wc -l && grep '^not ok ' kselftest-after.log | wc -l
67
68

[bmastbergen]

@jainanmol84 The content of the commit looks good. But I think you put the upstream commit hash in the 'cve' field of the commit message instead of CVE-2024-53141

[jainanmol84]

@jainanmol84 The content of the commit looks good. But I think you put the upstream commit hash in the 'cve' field of the commit message instead of CVE-2024-53141

Thanks for pointing that out. I’ve updated the commit message

[PlaidCat]

@jainanmol84 The content of the commit looks good. But I think you put the upstream commit hash in the 'cve' field of the commit message instead of CVE-2024-53141

Thanks for pointing that out. I’ve updated the commit message

It is still that way, if you updated it with git commit --amend you need to do a git push -f <branch> to force overwrite the branch

[thefossguy-ciq]

Basically, you need to change the actual commit message instead of the GitHub comment. As Maple said, run git commit --amend, modify the commit message there and the force push using git push -f origin ajain}_ciqlts9_2.

[bmastbergen]

🥌

[thefossguy-ciq]

🚤