ctnetlink_parse_expect_nat() reads the CTA_EXPECT_NAT_DIR attribute from userspace via netlink and assigns it to exp->dir without checking whether it is a valid direction value. Since exp->dir is used as an array index into the 2-element tuplehash[] array, an out-of-range value causes an out-of-bounds access. Add a bounds check to ensure the direction is less than IP_CT_DIR_MAX. Fixes: 076a0ca02644 ("netfilter: ctnetlink: add NAT support for expectations") Reported-by: Klaudia Kloc Reported-by: Dawid Moczadło Tested-by: Jenny Guanni Qu Signed-off-by: Jenny Guanni Qu --- net/netfilter/nf_conntrack_netlink.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c index 6a1239433830..ddf3a417f408 100644 --- a/net/netfilter/nf_conntrack_netlink.c +++ b/net/netfilter/nf_conntrack_netlink.c @@ -3496,6 +3496,8 @@ ctnetlink_parse_expect_nat(const struct nlattr *attr, exp->saved_addr = nat_tuple.src.u3; exp->saved_proto = nat_tuple.src.u; exp->dir = ntohl(nla_get_be32(tb[CTA_EXPECT_NAT_DIR])); + if (exp->dir >= IP_CT_DIR_MAX) + return -EINVAL; return 0; #else -- 2.34.1