From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=209.85.214.178 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1792689777; b=mJie1gO+u67zTxHSJ1UhjtcbjNtj6e4qVZenmSLiim1tp0xcNzVciJAIbRhS2FzZ1tO1 zGPjARqzgAUCfTfMJnOwQojmunQGTXxFcy3O+ZmhkTDCrHG2SMAGyqfX8bG6B+dsjsI9i yicfqILmXZL9oHDPGYDSTSSgrjZhSAn+wMjkqJE50787GGbBXKo/5Dz221ZtvBY2GwLfz 9VRbxK8rs3DTrnd/MRvGsr1aXcHhcuESDiRVXs9JvDrzDMBDzo01wQa2SbswCtdaeZUDX +3LkoDr/lpGffhV2wOj4zXhMg9m4onuDAzZPVhCxJuzGKahGw480iawj39vaoK1BQnA== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1792689777; h=DMARC-Filter:Received:DKIM-Signature:X-Google-DKIM-Signature: X-Forwarded-Encrypted:X-Gm-Message-State:X-Gm-Gg:X-Received:Received: From:To:Cc:Subject:Date:Message-ID:X-Mailer:MIME-Version: Content-Transfer-Encoding; bh=3Fxnb+tmDz8vD/RCSb1yDfS8uHLVRtbiJwimxAWXwl8=; b=s2llSi9IT3BIk1Kq5ZrexDWOicDlza87CB0E3g8H4Qr4BjAkPVLJxrytgujAGFIMEbd/ Qb7qXNCgQompYVydEVHQN9W7Z6SpM9MC35Nd8/GYcEx+Qlmrcq12S7YoaROlsYlsTRMgH oePG1T7zQjpezFn2aqAGlEBM0jrU94o1Kl5+Qpx9vxArBHwHoSw8dDX2vXtgt8zDEFueF 0CPdJklD4544nsv1XJSvcQetsDZ0Oof926Nm1y9XlPtlIWXwFwGH6j4/qn4pODFAlKMVN IQ7u1jC6KAYCBw/JaFfyM5l9TYB6KbOnod/xkgKl1bTmUEKUAPzT63ter4xgi0KX3Rw== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20251104 header.b=D7y+e548; arc=none smtp.remote-ip=209.85.214.178 Received: from mail-pl1-f178.google.com (mail-pl1-f178.google.com [209.85.214.178]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature ECDSA (prime256v1) server-digest SHA256) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A1986606A31A for ; Thu, 22 Oct 2026 17:22:56 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.2 smtp.subspace.kernel.org A1986606A31A Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key, unprotected) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20251104 header.b=D7y+e548 Received: by mail-pl1-f178.google.com with SMTP id d9443c01a7336-2e9e53d011eso13170205ad.1 for ; Thu, 22 Oct 2026 10:22:56 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1792689776; x=1793294576; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=3Fxnb+tmDz8vD/RCSb1yDfS8uHLVRtbiJwimxAWXwl8=; b=D7y+e548RrVflPxq20p6GTx6fhtREdk3YQuLBVSgVzBv+bTswPoGTzj3iua7j9o1dk 6YR/zzZ5fm9OmD91z2AUk2nEWIDH5+2Hv5gClEbE+knloO7Y4EiOheYnaoQc81H9Zp4B XWFsHK0v+nRiIcSyej8SvGnzPruFGf0D/+D6vPIJU+ZOQ32+dHKDgWBYjAnfpK4HXygv RzeRMc5jur2GRVX5+GDojE4Dcyy0ZLU5AHJxovZSFddDPdli05xu93cgEXlL/d0ZXMVw 2TxF61j6SxekpAzrwUvE9mm3i8GCMX17RUE/tqzyT2Hc4OjX32M0fY2ovHrIRIHpizwn 4S1g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792689776; x=1793294576; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=3Fxnb+tmDz8vD/RCSb1yDfS8uHLVRtbiJwimxAWXwl8=; b=asrjDsDWQwUPiejkciNZF66uqw64EphY6lUJciMeTon55gIPLFJxPY69y4KBKP1xV0 n4IfJ5UBoTGGPqBfyCFVUu+OJvjIkETXjs2lpSltoZQ5WdAvSxfn79C9GaO6HPDVHe/r ldMj3PIZZgzMZSmznajJgK6GKA01OI1EBCnnB4W9TUdFXFeXdE48k1oh3IkjsbwphMRZ ghIGwLaZKzrr0n+xdqJzzBEWN0wpn0weydoM9T+bVNGuqMPNRo4t8dYGog2HTXSeSMSh usqroeXeS47flWoO8RkQ45cRiUxjyvBAkT0sOcXPh8XCAyFRmHW2qbc0wvPBMD6+K+Px XdVA== X-Forwarded-Encrypted: i=1; AKwUvBzrEb1wa6KjkRljPNZoO195/Cj4/BmrRWkUdI93ELedE6OXX9IO/rku0Zfsh4D6sZixcmUG2vJl4hpool8=@vger.kernel.org X-Gm-Message-State: AFq9FYKIO8VZ0zsaVMxKroYbBDnCmiZd+wDqfsvV37ZRrNXHFY1yAkot pzdwGXxPrDhqyWZa6H6NansbT2uzLzJegzue/trS1v0kUCT1SEzru4+g X-Gm-Gg: AYBFou1YeB8S814Bq1dUTOClIfRQ3dUpZ9cToXTIxONrZEEpvTwsTqbad8K5VduVgha ylOkqCPh+66ACMJRGskrcFnmMVtfVtidQZER/SXGrNuaPfSaEp6Fa10ts4HqwzrnCIsXSo87ho8 pK29aV9slm+uU+yJqOFuYynXCMOISYIGtjVX5unX9K+SjiUluMu/gRxU1qvqtD/hxG9/ETRzPAW NdfVkmDFjySrCInnMrd937RLUXnN6Lf+t/X0TudKrYznQVB3eovSeuOqyqWkt6DLCUbfHHalK4e Ctmh21SmE5RLEwaai8F/mN4Lh9quNiDZmBy2Freah5VJ070lfL/JVXn7BbzfNcVZjg0ZIsZ0AaZ G/09WJ5XFfzdV2XE6ifDC7wNLS6DcdPOC7HM79rIqm01afLrD3c9VMKY03jK/wSv2TUoqKVikbi aJoTluImDdfxggPEDoTgShXCpZb9W6S8z9ASRV5acvnWrfXwJjBw1SU4gq1VM6XlPbaN/QWbHS6 tr3JNO6GvcqhizcFCh+fo/FOGjX6WnWUZhiR6ouqRjJXHogR82SEUKk/YcZXRNbgd1gqUFSRlT3 bWTq94LLMGx9wY4PXYHliitehhbyPtQRxXMSYDSyqlSDy8CrUZAz8SXI9sNlovFjhisq9sDm8rT /qXkx6ncEYLI= X-Received: by 2002:a17:903:1acc:b0:2e5:cb1f:898c with SMTP id d9443c01a7336-2ea43fb8270mr49485025ad.46.1792689775940; Thu, 22 Oct 2026 10:22:55 -0700 (PDT) Received: from test.. ([118.68.116.19]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2ea7b3bc816sm1217915ad.51.2026.10.22.10.22.53 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 22 Oct 2026 10:22:55 -0700 (PDT) From: Duc Anh Luu To: pablo@netfilter.org, fw@strlen.de Cc: netfilter-devel@vger.kernel.org, phil@nwl.cc, coreteam@netfilter.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org, Duc Anh Luu Subject: [PATCH] netfilter: nf_conntrack_sip: fix out-of-bounds read in ct_sip_parse_transport() Date: Fri, 23 Oct 2026 00:22:48 +0700 Message-ID: <20261022172248.554687-1-luuducanh05051995@gmail.com> X-Mailer: git-send-email 2.43.0 X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit ct_sip_parse_transport() compares the "transport=" parameter value against "TCP" and "UDP" with a fixed length of 3, without first checking that the parsed value is that long: if (ct_sip_parse_param(ct, dptr, dataoff, datalen, "transport=", &matchoff, &matchlen)) { if (!strncasecmp(dptr + matchoff, "TCP", strlen("TCP"))) ... ct_sip_parse_param() sets the value end to the surrounding limit when no ';' delimiter follows, and that limit can be the end of the SIP message (dptr + datalen) when no ',' is present either. A Contact/Via parameter such as "transport=tc" placed at the very end of the payload therefore yields matchlen < 3 with matchoff + matchlen == datalen, and the strncasecmp() reads up to two bytes past the end of the message buffer. The value of the over-read bytes can also flip the detected transport, so this is not purely a read: a crafted short value can make the helper classify the transport using out-of-bounds data. Both call sites (process_register_request() and process_register_response()) are reached from attacker-supplied SIP traffic when the nf_conntrack_sip helper is active. Bound each comparison by matchlen. A value shorter than three characters can never equal "TCP"/"UDP", so this only rejects already-malformed input and leaves valid transports (TCP, UDP, TLS, SCTP, ...) unchanged. Reachability and behavioural equivalence were verified with a userspace ASan harness built from the verbatim parser functions: the over-read is confirmed as a read past dptr + datalen, and the fix removes it while producing identical results for all well-formed transport values. Fixes: f5b321bd37fb ("netfilter: nf_conntrack_sip: add TCP support") Signed-off-by: Duc Anh Luu --- net/netfilter/nf_conntrack_sip.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/net/netfilter/nf_conntrack_sip.c b/net/netfilter/nf_conntrack_sip.c index 64bc440b1181..1f9cf75c7bd5 100644 --- a/net/netfilter/nf_conntrack_sip.c +++ b/net/netfilter/nf_conntrack_sip.c @@ -701,9 +701,11 @@ static int ct_sip_parse_transport(struct nf_conn *ct, const char *dptr, if (ct_sip_parse_param(ct, dptr, dataoff, datalen, "transport=", &matchoff, &matchlen)) { - if (!strncasecmp(dptr + matchoff, "TCP", strlen("TCP"))) + if (matchlen >= 3 && + !strncasecmp(dptr + matchoff, "TCP", strlen("TCP"))) *proto = IPPROTO_TCP; - else if (!strncasecmp(dptr + matchoff, "UDP", strlen("UDP"))) + else if (matchlen >= 3 && + !strncasecmp(dptr + matchoff, "UDP", strlen("UDP"))) *proto = IPPROTO_UDP; else return 0; -- 2.43.0