From: Kyle Zeng <kylebot@openai.com>

The inet ingress hook runs before ip_rcv_core(), so IPCB has not been
initialized when nft_reject_inet passes an IPv4 packet to
nf_send_unreach(). skb->cb can therefore retain data from an earlier
protocol layer.

icmp_send() treats IPCB(skb)->opt as parsed IPv4 options. Stale option
offsets can make __ip_options_echo() copy an attacker-controlled length
into its 40-byte reply option buffer and overflow the stack.

Clear IPCB for NF_INET_INGRESS and restore its input interface, matching
the initialization normally performed by ip_rcv_core().

Fixes: 117ca1f8920c ("netfilter: nft_reject_inet: allow to use reject from inet ingress")
Assisted-by: Codex:gpt-5.6-sol Codex:gpt-5.5-cyber
Signed-off-by: Kyle Zeng <kylebot@openai.com>
Co-developed-by: David Lee <david.lee@trailofbits.com>
Signed-off-by: David Lee <david.lee@trailofbits.com>
---
Bug found and triaged by OpenAI Security Research and
validated by Trail of Bits.

Trail of Bits has a reproducer for this bug that triggers a
KASAN stack-out-of-bounds write in __ip_options_echo() and can share
if needed.

 net/ipv4/netfilter/nf_reject_ipv4.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/net/ipv4/netfilter/nf_reject_ipv4.c b/net/ipv4/netfilter/nf_reject_ipv4.c
index 4626dc468..4933f6513 100644
--- a/net/ipv4/netfilter/nf_reject_ipv4.c
+++ b/net/ipv4/netfilter/nf_reject_ipv4.c
@@ -355,6 +355,12 @@ void nf_send_unreach(struct sk_buff *skb_in, int code, int hook)
 	if (!skb_dst(skb_in) && nf_reject_fill_skb_dst(skb_in) < 0)
 		return;
 
+	/* Inet ingress runs before IPv4 initializes IPCB. */
+	if (hook == NF_INET_INGRESS) {
+		memset(IPCB(skb_in), 0, sizeof(*IPCB(skb_in)));
+		IPCB(skb_in)->iif = skb_in->skb_iif;
+	}
+
 	if (skb_csum_unnecessary(skb_in) ||
 	    !nf_reject_verify_csum(skb_in, dataoff, proto)) {
 		icmp_send(skb_in, ICMP_DEST_UNREACH, code, 0);
-- 
2.53.0

David Lee <david.lee@trailofbits.com> wrote:
> From: Kyle Zeng <kylebot@openai.com>
> 
> The inet ingress hook runs before ip_rcv_core(), so IPCB has not been
> initialized when nft_reject_inet passes an IPv4 packet to
> nf_send_unreach(). skb->cb can therefore retain data from an earlier
> protocol layer.
> 
> icmp_send() treats IPCB(skb)->opt as parsed IPv4 options. Stale option
> offsets can make __ip_options_echo() copy an attacker-controlled length
> into its 40-byte reply option buffer and overflow the stack.
> 
> Clear IPCB for NF_INET_INGRESS and restore its input interface, matching
> the initialization normally performed by ip_rcv_core().

Will you also send a patch for net/ipv6/netfilter/nf_reject_ipv6.c ?

Or: send a v2 that also fixes this up,
Or: send a v2 that mentions why net/ipv6/netfilter/nf_reject_ipv6.c is
fine (I doubt it).