Skip to content

Commit 75e19ce

Browse files
committed
netfilter: nf_tables: allow to fetch set elements when table has an owner
jira VULN-430 cve-pre CVE-2023-4244 commit-author Pablo Neira Ayuso <pablo@netfilter.org> commit 92f3e96 NFT_MSG_GETSETELEM returns -EPERM when fetching set elements that belong to table that has an owner. This results in empty set/map listing from userspace. Fixes: 6001a93 ("netfilter: nftables: introduce table ownership") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> (cherry picked from commit 92f3e96) Signed-off-by: Marcin Wcisło <marcin.wcislo@conclusive.pl>
1 parent 530707e commit 75e19ce

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

net/netfilter/nf_tables_api.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5525,7 +5525,7 @@ static int nf_tables_getsetelem(struct sk_buff *skb,
55255525
int rem, err = 0;
55265526

55275527
table = nft_table_lookup(net, nla[NFTA_SET_ELEM_LIST_TABLE], family,
5528-
genmask, NETLINK_CB(skb).portid);
5528+
genmask, 0);
55295529
if (IS_ERR(table)) {
55305530
NL_SET_BAD_ATTR(extack, nla[NFTA_SET_ELEM_LIST_TABLE]);
55315531
return PTR_ERR(table);

0 commit comments

Comments
 (0)