Commit 78216189 authored by Pablo Neira Ayuso's avatar Pablo Neira Ayuso
Browse files

netfilter: ctnetlink: use helper function to calculate expect ID 



Delete expectation path is missing a call to the nf_expect_get_id()
helper function to calculate the expectation ID, otherwise LSB of the
expectation object address is leaked to userspace.

Fixes: 3c791076 ("netfilter: ctnetlink: don't use conntrack/expect object addresses as id")
Reported-by: default avatar <zdi-disclosures@trendmicro.com>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 0e03c643

net/netfilter/nf_conntrack_netlink.c

+2 −1
Original line number Diff line number Diff line
@@ -3420,7 +3420,8 @@ static int ctnetlink_del_expect(struct sk_buff *skb, 


		if (cda[CTA_EXPECT_ID]) {

			__be32 id = nla_get_be32(cda[CTA_EXPECT_ID]);

			if (ntohl(id) != (u32)(unsigned long)exp) {



			if (id != nf_expect_get_id(exp)) {

				nf_ct_expect_put(exp);

				return -ENOENT;

			}