[fips-legacy-8] netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro for ip_…

[bmastbergen]

…set_hash_netportnet.c

jira VULN-8849
cve CVE-2023-42753

commit-author Kyle Zeng <[email protected]>
commit 050d91c03b28ca479df13dfb02bcd2c60dd6a878

The missing IP_SET_HASH_WITH_NET0 macro in ip_set_hash_netportnet can lead to the use of wrong `CIDR_POS(c)` for calculating array offsets, which can lead to integer underflow. As a result, it leads to slab out-of-bound access.
This patch adds back the IP_SET_HASH_WITH_NET0 macro to ip_set_hash_netportnet to address the issue.

Fixes: 886503f34d63 ("netfilter: ipset: actually allow allowable CIDR 0 in hash:net,port,net")
	Suggested-by: Jozsef Kadlecsik <[email protected]>
	Signed-off-by: Kyle Zeng <[email protected]>
	Acked-by: Jozsef Kadlecsik <[email protected]>
	Signed-off-by: Florian Westphal <[email protected]>
(cherry picked from commit 050d91c03b28ca479df13dfb02bcd2c60dd6a878)
	Signed-off-by: Brett Mastbergen <[email protected]>

Build Log

/home/brett/kernel-src-tree
  CLEAN   scripts/basic
  CLEAN   scripts/kconfig
  CLEAN   include/config include/generated arch/x86/include/generated
  CLEAN   .config .config.old
[TIMER]{MRPROPER}: 12s
x86_64 architecture detected, copying config
'configs/kernel-x86_64.config' -> '.config'
Setting Local Version for build
CONFIG_LOCALVERSION="-b_f-l-8-c_4.18.0-425.13.1_VULN-8849-31e08dfe24fe"
Making olddefconfig
--
  HOSTLD  scripts/kconfig/conf
scripts/kconfig/conf  --olddefconfig Kconfig
#
# configuration written to .config
#
Starting Build
scripts/kconfig/conf  --syncconfig Kconfig
  SYSTBL  arch/x86/include/generated/asm/syscalls_32.h
  SYSHDR  arch/x86/include/generated/asm/unistd_64_x32.h
  SYSHDR  arch/x86/include/generated/asm/unistd_32_ia32.h
  SYSTBL  arch/x86/include/generated/asm/syscalls_64.h
--
  LD [M]  sound/usb/usx2y/snd-usb-usx2y.ko
  LD [M]  sound/virtio/virtio_snd.ko
  LD [M]  sound/x86/snd-hdmi-lpe-audio.ko
  LD [M]  sound/xen/snd_xen_front.ko
  LD [M]  virt/lib/irqbypass.ko
[TIMER]{BUILD}: 1578s
Making Modules
  INSTALL arch/x86/crypto/blowfish-x86_64.ko
  INSTALL arch/x86/crypto/camellia-aesni-avx-x86_64.ko
  INSTALL arch/x86/crypto/camellia-aesni-avx2.ko
  INSTALL arch/x86/crypto/camellia-x86_64.ko
--
  INSTALL sound/virtio/virtio_snd.ko
  INSTALL sound/x86/snd-hdmi-lpe-audio.ko
  INSTALL sound/xen/snd_xen_front.ko
  INSTALL virt/lib/irqbypass.ko
  DEPMOD  4.18.0-b_f-l-8-c_4.18.0-425.13.1_VULN-8849-31e08dfe24fe+
[TIMER]{MODULES}: 12s
Making Install
sh ./arch/x86/boot/install.sh 4.18.0-b_f-l-8-c_4.18.0-425.13.1_VULN-8849-31e08dfe24fe+ arch/x86/boot/bzImage \
	System.map "/boot"
[TIMER]{INSTALL}: 95s
Checking kABI
Checking kABI
kABI check passed
Setting Default Kernel to /boot/vmlinuz-4.18.0-b_f-l-8-c_4.18.0-425.13.1_VULN-8849-31e08dfe24fe+ and Index to 2
Hopefully Grub2.0 took everything ... rebooting after time metrices
[TIMER]{MRPROPER}: 12s
[TIMER]{BUILD}: 1578s
[TIMER]{MODULES}: 12s
[TIMER]{INSTALL}: 95s
[TIMER]{TOTAL} 1713s
Rebooting in 10 seconds

Testing

kselftests were run before and after applying the fix

selftest-4.18.0-425.13.1.el8.ciqfipscompliant.40.1.x86_64.log

selftest-4.18.0-b_f-l-8-c_4.18.0-425.13.1_VULN-8849-31e08dfe24fe+.log

brett@lycia ~/ciq/vuln-8849 % grep ^ok selftest-4.18.0-425.13.1.el8.ciqfipscompliant.40.1.x86_64.log | wc -l
230
brett@lycia ~/ciq/vuln-8849 % grep ^ok selftest-4.18.0-b_f-l-8-c_4.18.0-425.13.1_VULN-8849-31e08dfe24fe+.log | wc -l
230
brett@lycia ~/ciq/vuln-8849 %

[PlaidCat]

[thefossguy-ciq]

I was going crazy over this CVE patch because the macro didn't seem to be consumed elsewhere. Usually the consumer is added in the same (or following) patch but it appears that this is intended to be consumed by the net/netfilter/ipset/ip_set_hash_gen.h header file.

[thefossguy-ciq]

🚤