In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
netfilter: nf_conncount: fix zone comparison in tuple dedup<\/p>\n
The “already exists” dedup logic in __nf_conncount_add() decides
\nwhether a connection has already been counted and can be skipped instead
\nof incrementing the connlimit count. It compares the conntrack zone of a
\nlist entry with the zone of the connection being added using
\nnf_ct_zone_id() and nf_ct_zone_equal(), passing conn->zone.dir or
\nzone->dir as the direction argument.<\/p>\n
Those helpers take enum ip_conntrack_dir values: IP_CT_DIR_ORIGINAL is 0
\nand IP_CT_DIR_REPLY is 1. However, zone->dir is a u8 bitmask:
\nNF_CT_ZONE_DIR_ORIG is 1, NF_CT_ZONE_DIR_REPL is 2 and
\nNF_CT_DEFAULT_ZONE_DIR is 3. Passing that bitmask as the enum direction
\nshifts the meaning of every non-zero value. An ORIG-only zone passes 1
\nand is tested as REPLY, while REPL-only and default zones pass 2 or 3 and
\ntest bits beyond the valid direction range. In those cases
\nnf_ct_zone_id() can fall back to NF_CT_DEFAULT_ZONE_ID instead of using
\nthe real zone id, so different zones can be treated as equal and dedup
\ncollapses to tuple equality alone.<\/p>\n
nf_conncount stores and compares the original-direction tuple for a
\nconnection. If an skb already has an attached conntrack entry,
\nget_ct_or_tuple_from_skb() explicitly copies
\nct->tuplehash[IP_CT_DIR_ORIGINAL].tuple, regardless of the packet’s
\nctinfo. Therefore the zone comparison in the tuple dedup path must use
\nIP_CT_DIR_ORIGINAL as well; the zone direction bitmask describes where a
\nzone id applies, not which direction this conncount tuple represents.<\/p>\n
Fix the two dedup comparisons by passing IP_CT_DIR_ORIGINAL directly.
\nDo not special-case NF_CT_DEFAULT_ZONE_DIR and do not compare raw zone
\nids: using the existing helpers with IP_CT_DIR_ORIGINAL preserves the
\ndirection-aware NF_CT_DEFAULT_ZONE_ID fallback. A default bidirectional
\nzone contains the ORIG bit, so it naturally returns the real zone id;
\nreply-only zones continue to fall back for original-direction tuple
\ncomparisons.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
netfilter: nf_conncount: fix zone comparison in tuple dedup<\/p>\n
The “already exists” dedup logic in __nf_conncount_add() decides
\nwheth<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-6865","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/6865","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=6865"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=6865"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=6865"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}