cve/published/2021/CVE-2021-46915.mbox

From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: <linux-cve-announce@vger.kernel.org>
Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org>
Subject: CVE-2021-46915: netfilter: nft_limit: avoid possible divide error in nft_limit_init

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nft_limit: avoid possible divide error in nft_limit_init

div_u64() divides u64 by u32.

nft_limit_init() wants to divide u64 by u64, use the appropriate
math function (div64_u64)

divide error: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 8390 Comm: syz-executor188 Not tainted 5.12.0-rc4-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:div_u64_rem include/linux/math64.h:28 [inline]
RIP: 0010:div_u64 include/linux/math64.h:127 [inline]
RIP: 0010:nft_limit_init+0x2a2/0x5e0 net/netfilter/nft_limit.c:85
Code: ef 4c 01 eb 41 0f 92 c7 48 89 de e8 38 a5 22 fa 4d 85 ff 0f 85 97 02 00 00 e8 ea 9e 22 fa 4c 0f af f3 45 89 ed 31 d2 4c 89 f0 <49> f7 f5 49 89 c6 e8 d3 9e 22 fa 48 8d 7d 48 48 b8 00 00 00 00 00
RSP: 0018:ffffc90009447198 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000200000000000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff875152e6 RDI: 0000000000000003
RBP: ffff888020f80908 R08: 0000200000000000 R09: 0000000000000000
R10: ffffffff875152d8 R11: 0000000000000000 R12: ffffc90009447270
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
FS:  000000000097a300(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000200001c4 CR3: 0000000026a52000 CR4: 00000000001506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 nf_tables_newexpr net/netfilter/nf_tables_api.c:2675 [inline]
 nft_expr_init+0x145/0x2d0 net/netfilter/nf_tables_api.c:2713
 nft_set_elem_expr_alloc+0x27/0x280 net/netfilter/nf_tables_api.c:5160
 nf_tables_newset+0x1997/0x3150 net/netfilter/nf_tables_api.c:4321
 nfnetlink_rcv_batch+0x85a/0x21b0 net/netfilter/nfnetlink.c:456
 nfnetlink_rcv_skb_batch net/netfilter/nfnetlink.c:580 [inline]
 nfnetlink_rcv+0x3af/0x420 net/netfilter/nfnetlink.c:598
 netlink_unicast_kernel net/netlink/af_netlink.c:1312 [inline]
 netlink_unicast+0x533/0x7d0 net/netlink/af_netlink.c:1338
 netlink_sendmsg+0x856/0xd90 net/netlink/af_netlink.c:1927
 sock_sendmsg_nosec net/socket.c:654 [inline]
 sock_sendmsg+0xcf/0x120 net/socket.c:674
 ____sys_sendmsg+0x6e8/0x810 net/socket.c:2350
 ___sys_sendmsg+0xf3/0x170 net/socket.c:2404
 __sys_sendmsg+0xe5/0x1b0 net/socket.c:2433
 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xae

The Linux kernel CVE team has assigned CVE-2021-46915 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 4.13 with commit c26844eda9d4fdbd266660e3b3de2d0270e3a1ed and fixed in 4.14.232 with commit 9065ccb9ec92c5120e7e97958397ebdb454f23d6
	Issue introduced in 4.13 with commit c26844eda9d4fdbd266660e3b3de2d0270e3a1ed and fixed in 4.19.189 with commit fadd3c4afdf3d4c21f4d138502f8b76334987e26
	Issue introduced in 4.13 with commit c26844eda9d4fdbd266660e3b3de2d0270e3a1ed and fixed in 5.4.114 with commit 01fb1626b620cb37a65ad08e0f626489e8f042ef
	Issue introduced in 4.13 with commit c26844eda9d4fdbd266660e3b3de2d0270e3a1ed and fixed in 5.10.32 with commit dc1732baa9da5b68621586bf8636ebbc27dc62d2
	Issue introduced in 4.13 with commit c26844eda9d4fdbd266660e3b3de2d0270e3a1ed and fixed in 5.11.16 with commit 1bb3ee4259936cc3b2d80a4a480bbb4868575071
	Issue introduced in 4.13 with commit c26844eda9d4fdbd266660e3b3de2d0270e3a1ed and fixed in 5.12 with commit b895bdf5d643b6feb7c60856326dd4feb6981560

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2021-46915
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/netfilter/nft_limit.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/9065ccb9ec92c5120e7e97958397ebdb454f23d6
	https://git.kernel.org/stable/c/fadd3c4afdf3d4c21f4d138502f8b76334987e26
	https://git.kernel.org/stable/c/01fb1626b620cb37a65ad08e0f626489e8f042ef
	https://git.kernel.org/stable/c/dc1732baa9da5b68621586bf8636ebbc27dc62d2
	https://git.kernel.org/stable/c/1bb3ee4259936cc3b2d80a4a480bbb4868575071
	https://git.kernel.org/stable/c/b895bdf5d643b6feb7c60856326dd4feb6981560