CVE-2025-38162
netfilter: nft_set_pipapo: prevent overflow in lookup table allocation
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
netfilter: nft_set_pipapo: prevent overflow in lookup table allocation
In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_pipapo: prevent overflow in lookup table allocation When calculating the lookup table size, ensure the following multiplication does not overflow: - desc->field_len[] maximum value is U8_MAX multiplied by NFT_PIPAPO_GROUPS_PER_BYTE(f) that can be 2, worst case. - NFT_PIPAPO_BUCKETS(f->bb) is 2^8, worst case. - sizeof(unsigned long), from sizeof(*f->lt), lt in struct nft_pipapo_field. Then, use check_mul_overflow() to multiply by bucket size and then use check_add_overflow() to the alignment for avx2 (if needed). Finally, add lt_size_check_overflow() helper and use it to consolidate this. While at it, replace leftover allocation using the GFP_KERNEL to GFP_KERNEL_ACCOUNT for consistency, in pipapo_resize().
Reserved 2025-04-16 | Published 2025-07-03 | Updated 2025-07-03 | Assigner Linuxgit.kernel.org/...c/c1360ac8156c0a3f2385baef91d8d26fd9d39701
git.kernel.org/...c/43fe1181f738295624696ae9ff611790edb65b5e
git.kernel.org/...c/4c5c6aa9967dbe55bd017bb509885928d0f31206
Support options
