In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
netfilter: nf_nat: avoid invalid nat_net pointer use on failed nf_nat_init()<\/p>\n
We ran into below KASAN splat, which is mostly uninteresting, beside
\nfor having nf_nat_register_fn() in the call chain as a cause for the
\noffending access:<\/p>\n
==================================================================
\nBUG: KASAN: slab-out-of-bounds in nf_nat_register_fn+0x5f9\/0x640
\nRead of size 8 at addr ffff890031e54c20 by task iptables\/9510<\/p>\n
CPU: 0 UID: 0 PID: 9510 Comm: iptables Not tainted 6.18.18-grsec-full-20260320181326 #1 PREEMPT(voluntary)
\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04\/01\/2014
\nCall Trace:<\/p>\n
[\u2026] dump_stack_lvl+0xee\/0x160 ffff88004117eeb8
\n [\u2026] print_report+0x6e\/0x640 ffff88004117eee0
\n [\u2026] ? __phys_addr+0x8e\/0x140 ffff88004117eef0
\n [\u2026] ? kasan_addr_to_slab+0x51\/0xe0 ffff88004117ef08
\n [\u2026] ? complete_report_info+0xec\/0x1c0 ffff88004117ef20
\n [\u2026] ? nf_nat_register_fn+0x5f9\/0x640 ffff88004117ef48
\n [\u2026] kasan_report+0xbc\/0x140 ffff88004117ef50
\n [\u2026] ? nf_nat_register_fn+0x5f9\/0x640 ffff88004117ef90
\n [\u2026] nf_nat_register_fn+0x5f9\/0x640 ffff88004117eff8
\n [\u2026] ? nf_nat_icmp_reply_translation+0x6e0\/0x6e0 ffff88004117f070
\n [\u2026] nf_tables_register_hook.part.0+0xa0\/0x220 ffff88004117f080
\n [\u2026] nf_tables_addchain.constprop.0+0x1054\/0x1fc0 ffff88004117f0b8
\n [\u2026] ? nft_chain_lookup.part.0+0x4ce\/0xac0 ffff88004117f130
\n [\u2026] ? nf_tables_abort+0x3d80\/0x3d80 ffff88004117f190
\n [\u2026] ? nf_tables_dumpreset_obj+0x100\/0x100 ffff88004117f1c8
\n [\u2026] ? nft_table_lookup.part.0+0x255\/0x300 ffff88004117f310
\n [\u2026] ? nf_tables_newchain+0x21a4\/0x2fa0 ffff88004117f358
\n [\u2026] nf_tables_newchain+0x21a4\/0x2fa0 ffff88004117f360
\n [\u2026] ? nf_tables_addchain.constprop.0+0x1fc0\/0x1fc0 ffff88004117f458
\n [\u2026] ? nla_get_range_signed+0x4a0\/0x4a0 ffff88004117f488
\n [\u2026] ? lock_acquire+0x16f\/0x320 ffff88004117f490
\n [\u2026] ? find_held_lock+0x3b\/0xe0 ffff88004117f4b0
\n [\u2026] ? __nla_parse+0x45\/0x80 ffff88004117f500
\n [\u2026] nfnetlink_rcv_batch+0xbca\/0x19a0 ffff88004117f550
\n [\u2026] ? nfnetlink_net_exit_batch+0x120\/0x120 ffff88004117f618
\n [\u2026] ? __sanitizer_cov_trace_switch+0x63\/0xe0 ffff88004117f720
\n [\u2026] ? gr_acl_handle_mmap+0x1c4\/0x320 ffff88004117f7c0
\n [\u2026] ? nla_get_range_signed+0x4a0\/0x4a0 ffff88004117f7e8
\n [\u2026] ? gr_is_capable+0x6f\/0xe0 ffff88004117f830
\n [\u2026] ? __nla_parse+0x45\/0x80 ffff88004117f860
\n [\u2026] ? skb_pull+0x103\/0x1a0 ffff88004117f880
\n [\u2026] nfnetlink_rcv+0x3db\/0x4a0 ffff88004117f8b0
\n [\u2026] ? nfnetlink_rcv_batch+0x19a0\/0x19a0 ffff88004117f8d8
\n [\u2026] ? netlink_lookup+0xe2\/0x240 ffff88004117f900
\n [\u2026] netlink_unicast+0x74b\/0xb00 ffff88004117f930
\n [\u2026] ? netlink_attachskb+0xb20\/0xb20 ffff88004117f980
\n [\u2026] ? __check_object_size+0x3e\/0xaa0 ffff88004117f998
\n [\u2026] ? security_netlink_send+0x51\/0x160 ffff88004117f9c8
\n [\u2026] netlink_sendmsg+0xa03\/0x1200 ffff88004117f9f8
\n [\u2026] ? netlink_unicast+0xb00\/0xb00 ffff88004117fa70
\n [\u2026] ? netlink_unicast+0xb00\/0xb00 ffff88004117fac8
\n [\u2026] ? ____sys_sendmsg+0xe2a\/0x1040 ffff88004117faf8
\n [\u2026] ____sys_sendmsg+0xe2a\/0x1040 ffff88004117fb00
\n [\u2026] ? kernel_recvmsg+0x300\/0x300 ffff88004117fb60
\n [\u2026] ? reacquire_held_locks+0xe9\/0x260 ffff88004117fbc8
\n [\u2026] ___sys_sendmsg+0x138\/0x200 ffff88004117fbf8
\n [\u2026] ? do_recvmmsg+0x7e0\/0x7e0 ffff88004117fc30
\n [\u2026] ? lockdep_hardirqs_on_prepare+0x101\/0x1e0 ffff88004117fc50
\n [\u2026] ? lock_acquire+0x16f\/0x320 ffff88004117fd20
\n [\u2026] ? lock_acquire+0x16f\/0x320 ffff88004117fd58
\n [\u2026] ? find_held_lock+0x3b\/0xe0 ffff88004117fd70
\n [\u2026] __sys_sendmsg+0x17a\/0x260 ffff88004117fdc8
\n [\u2026] ? __sys_sendmsg_sock+0x80\/0x80 ffff88004117fdf0
\n [\u2026] ? syscall_trace_enter+0x15e\/0x2c0 ffff88004117fe98
\n [\u2026] do_syscall_64+0x7d\/0x400 ffff88004117fec8
\n [\u2026] entry_SYSCALL_64_safe_stack+0x4a\/0x60 ffff88004117fef8<\/p>\n
==================================================================<\/p>\n
The out-of-bounds report, though, is a red herring as it is f
\n—truncated—<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
netfilter: nf_nat: avoid invalid nat_net pointer use on failed nf_nat_init()<\/p>\n
We ran into below KASAN splat, which is mostly uninte<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-7073","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/7073","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=7073"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=7073"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=7073"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}