ipmr_cache_report() copies ip_hdrlen(pkt) bytes from pkt->data into a freshly allocated 128-byte skb that is delivered to userspace via the mrouted IGMP raw socket and via igmpmsg_netlink_event: const int ihl = ip_hdrlen(pkt); ... skb_put(skb, ihl); skb_copy_to_linear_data(skb, pkt->data, ihl); ip_rcv_core() validates iph->ihl and pskb_may_pull()s ihl*4 bytes at parse time. An nftables PRE_ROUTING payload write reachable from an unprivileged user namespace can flip the ihl nibble from 5 to 15 between parse and ipmr_cache_report(). When the original skb is non-linear (received via a NIC driver that uses paged frags), only the parse-time ihl*4 = 20 bytes are in the linear region; the consumer copies 60 bytes, and the extra 40 bytes are read from skb_shared_info or adjacent slab memory and queued back to userspace, a kernel heap-content infoleak. PoC observation: recvfrom on the mroute socket returns 28 bytes without mutation, 68 bytes with mutation (40 extra bytes leaked). Clamp ihl against skb_headlen(pkt) so only bytes actually present in the linear region are copied. Cc: stable@vger.kernel.org Reported-by: Qi Tang Reported-by: Tong Liu Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Qi Tang --- net/ipv4/ipmr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c index 2628cd3a93a68..b40f3dd8f650f 100644 --- a/net/ipv4/ipmr.c +++ b/net/ipv4/ipmr.c @@ -1056,7 +1056,7 @@ static void ipmr_cache_resolve(struct net *net, struct mr_table *mrt, static int ipmr_cache_report(const struct mr_table *mrt, struct sk_buff *pkt, vifi_t vifi, int assert) { - const int ihl = ip_hdrlen(pkt); + const int ihl = min_t(int, ip_hdrlen(pkt), skb_headlen(pkt)); struct sock *mroute_sk; struct igmphdr *igmp; struct igmpmsg *msg; -- 2.47.3