[PATCH] netfilter: nf_conntrack_sip: fix out-of-bounds read in ct_sip_parse_transport()

[PATCH] netfilter: nf_conntrack_sip: fix out-of-bounds read in ct_sip_parse_transport()

[Duc Anh Luu]

ct_sip_parse_transport() compares the "transport=" parameter value against
"TCP" and "UDP" with a fixed length of 3, without first checking that the
parsed value is that long:

	if (ct_sip_parse_param(ct, dptr, dataoff, datalen, "transport=",
			       &matchoff, &matchlen)) {
		if (!strncasecmp(dptr + matchoff, "TCP", strlen("TCP")))
		...

ct_sip_parse_param() sets the value end to the surrounding limit when no
';' delimiter follows, and that limit can be the end of the SIP message
(dptr + datalen) when no ',' is present either. A Contact/Via parameter
such as "transport=tc" placed at the very end of the payload therefore
yields matchlen < 3 with matchoff + matchlen == datalen, and the
strncasecmp() reads up to two bytes past the end of the message buffer.

The value of the over-read bytes can also flip the detected transport,
so this is not purely a read: a crafted short value can make the helper
classify the transport using out-of-bounds data.

Both call sites (process_register_request() and
process_register_response()) are reached from attacker-supplied SIP
traffic when the nf_conntrack_sip helper is active.

Bound each comparison by matchlen. A value shorter than three characters
can never equal "TCP"/"UDP", so this only rejects already-malformed input
and leaves valid transports (TCP, UDP, TLS, SCTP, ...) unchanged.

Reachability and behavioural equivalence were verified with a userspace
ASan harness built from the verbatim parser functions: the over-read is
confirmed as a read past dptr + datalen, and the fix removes it while
producing identical results for all well-formed transport values.

Fixes: f5b321bd37fb ("netfilter: nf_conntrack_sip: add TCP support")
Signed-off-by: Duc Anh Luu <luuducanh05051995@gmail.com>
---
 net/netfilter/nf_conntrack_sip.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/net/netfilter/nf_conntrack_sip.c b/net/netfilter/nf_conntrack_sip.c
index 64bc440b1181..1f9cf75c7bd5 100644
--- a/net/netfilter/nf_conntrack_sip.c
+++ b/net/netfilter/nf_conntrack_sip.c
@@ -701,9 +701,11 @@ static int ct_sip_parse_transport(struct nf_conn *ct, const char *dptr,
 
 	if (ct_sip_parse_param(ct, dptr, dataoff, datalen, "transport=",
 			       &matchoff, &matchlen)) {
-		if (!strncasecmp(dptr + matchoff, "TCP", strlen("TCP")))
+		if (matchlen >= 3 &&
+		    !strncasecmp(dptr + matchoff, "TCP", strlen("TCP")))
 			*proto = IPPROTO_TCP;
-		else if (!strncasecmp(dptr + matchoff, "UDP", strlen("UDP")))
+		else if (matchlen >= 3 &&
+			 !strncasecmp(dptr + matchoff, "UDP", strlen("UDP")))
 			*proto = IPPROTO_UDP;
 		else
 			return 0;
-- 
2.43.0

Re: [PATCH] netfilter: nf_conntrack_sip: fix out-of-bounds read in ct_sip_parse_transport()

[netdev-bot+sinfo]

Hi!

This is an automated message. This series looks like a fix, but its
commit messages seem to be missing some information:

 - How the issue was discovered, e.g. hit in production, hit during
   development, syzbot report, manual code inspection, LLM or static
   analysis tool scan.

Please do not repost the series just to address the above. Instead,
reply to this email with the missing information, so that reviewers
can take it into account. If the series needs another revision for
other reasons, please include the information in the commit messages
then.

The evaluation is done by an LLM so it may be wrong, if you think
that is the case please reply and explain.