From nobody Tue Sep 29 02:05:08 2026 Received: from mail-pl1-f180.google.com (mail-pl1-f180.google.com [209.85.214.180]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 800E742A792 for ; Thu, 13 Aug 2026 16:59:42 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=pass smtp.client-ip=209.85.214.180 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786640383; cv=pass; b=S9Y9EBCn2Sc+guthBULaJFrxmh8wCQ7G66VoknEfHN2Vfl3f43eHPPq/yQ3xRZJHF85Gs5EUNu4bRubNr7Fqt1ZB1g9q3tafeMi4iCTKL2E8ZzzVcuUvNRBusMnSvfFGQvaZwo2surUge175/MEaIVeZyrFM57LuLHdwDaA/Uto= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786640383; c=relaxed/simple; bh=xoBdWEtJTPlDLVyNbMab7t+/J7TUwi1z7zZtLQ6klVM=; h=MIME-Version:From:Date:Message-ID:Subject:To:Cc:Content-Type; b=TQIHGXSF0Xu9KIlu3q3OQUMoTUZcz6DxAwhfSMhY28Xp6xN8QCFSWUVtBpE1p//2QTxAVdstkpgKVyYZC42pP+Qcv/TLVRwzHVMVyUG5+WzzDMp9SDgjoj6Tr9LjqCMOJfD+R+dO3DNihzBuZDj+LgMOqp0F7oiA3yW8uGNKcQo= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=Eoe0mBVp; arc=pass smtp.client-ip=209.85.214.180 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="Eoe0mBVp" Received: by mail-pl1-f180.google.com with SMTP id d9443c01a7336-2cf50c6f235so2377725ad.0 for ; Thu, 13 Aug 2026 09:59:42 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1786640382; cv=none; d=google.com; s=arc-20260327; b=f/WqZaToYN6L4Bl3AmxJGV7btgvF/N0Zme/HtePra3dQcvtHgFhFpijEEjac0jOYD/ CIe9D9ZwqgHrq3odASXiZQl+QRJipUVw1SwAuXSqYI8HE8/amF8ik4ttu/MBexcasbMa c1bMn+dCjHdwY8Kz/HDhQK+v4s1Kl0dyynDAvdwcZbKOOt5oTAelqNqrLBrHA/zLA/83 iHQaG+6nn7X+Wtw/DMqEVjHVOnodQqnVqoXnVyGihykaNjtvtjVLxCkJHxO+ASUEKbhF WTYZ0fDNXsj5+Ixeta+FAxl1cCCfBgZuUrEFGIhHVCaZYOft/qKJSNzV6a6N1wh/QMTh 3srA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=cc:to:subject:message-id:date:from:mime-version:dkim-signature; bh=5PCXtpD2RlzIqld0EEK6YS2HyVzJj+XySKEtASyVQ20=; fh=vEKswfVf+etGQihmi56bum17EnSifupaGhLWwAuIvzU=; b=UDPuHWNRP6BYcUTISkW8zmH2/6X/+adkZfJTY5Y0bB3YA5u++Fu5VjEQPRfGKBiM0F shkw57eTO+RUGYp3uzfCnYpjNu5fcfKMs1/diC7CcZRiaMDHkkl7BZl44TMtjKJrpHHw z1zSTLck7rfiZeLXZ8UbCQIDQsXJ0SlpKf2CNiFRcJvOS/+TCLfnczDGlbW+8bp54FR+ x+Wl1bFuR5plGvoAk2RQglHEA0y8/rop7OEU11lH14c136f1VmOrmCxT5vvoC7fg2ywN cSeUeFnKxXAXDMr/Y8WY6Fp82cqlbx1gauy6wVtbpQiPh4ds6vr/8xRGBp159n04X60F 5o8Q==; darn=vger.kernel.org ARC-Authentication-Results: i=1; mx.google.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1786640382; x=1787245182; darn=vger.kernel.org; h=content-type:cc:to:subject:message-id:date:from:mime-version:from :to:cc:subject:date:message-id:reply-to:content-type; bh=5PCXtpD2RlzIqld0EEK6YS2HyVzJj+XySKEtASyVQ20=; b=Eoe0mBVpeSDdi7T3XLAxzyHYM/od6gilK0FfqVVaQnZJYb6FAffj76MwK44CEVzxo2 lXpLCcfWLZ8F4f6y7n9iprcEXpf/LB/QinAUhfqR85T/QRXVJw1zfPbfA213B4qaLDYp atlsAA3O4a09qU+CdwO0K84bocjkDq/yaCphvjK/i9Lm2miLaRe3Ms3JgWyx3fyTMYZY G8l+iTgvoJcNCBROZuHQp6E+SHjZpCP37JK8UdS4tVmvPl3nhciAGcSLLMV3Em4vNSGf gsekNTEOAczWdL16NLWztGmQ4GbXSqn9UvXhmLELIa905JDObZu1vX4pO6TOTFFZLVKN 66iw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786640382; x=1787245182; h=content-type:cc:to:subject:message-id:date:from:mime-version :x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to:content-type; bh=5PCXtpD2RlzIqld0EEK6YS2HyVzJj+XySKEtASyVQ20=; b=qvDZWg5DcXSzPQa4PYV+3aCeGjDRJX9ogLJSSCealkMtxUz3DgpWCnTwK6tc7R61Tf p6oRQJtfyLTXLKZc8v2kj7Mqg2BBYl0Zw0OUPbnWE8vcw8k7Orm0keHTh6+dDhnmGo59 tTqTl1Uw/E88lHgsF+8IDJRKtYYDQ9M0Is/+UHXJg+3nWLdT3atwkiYoDqk/8vmNe0iD /xPx33zKS01Lljun7wd2Yu/xJ2J2+1R7Y3BN2i4zjHbaC8FcQhIAyHrXJe1PCeEPDEyx 2dJnwaqMvIz3hqz0F8zZpDuf+6WBg0fcWtMX4ZtPqnrjxJG3sagN+NyYk2kTonGIFCQ1 ldnQ== X-Forwarded-Encrypted: i=1; AHgh+RrIlkta+EhbpVo2Lx++oaqL4Pgjqg7D5YIXFqx7pLMMNHtBbVKJA2koZ6it0bf3FgGNJ07fXC7V8sa7x8M=@vger.kernel.org X-Gm-Message-State: AOJu0Yx5ouktN9AJ97w9uoQmHrws8cG6rbJSCV9L7NUmcocZBBgaNUU4 EQfpdKasV5cASa45AjCeVkYd+/qfXRhJQg+cgLlp9pftR3PfP6DAYDX1mrvpdiTWw8KOnMFSgaR yMfStCisPtKzkqLlVplae0nGl0qVxIig= X-Gm-Gg: AR+sD11B0zI+ZXmhH03VBdo0FxkUsfbKRcyqNLoL3VmPLr5QIQCZOpPKXdsVawRXIsE e1epFUobXRwuC3vcOgxLeWP+OIXYClkru6xxsdnYjS93MP5aRQnhTK7sX0g3ZTsPIoEZTj9TkoY yOSHkbfUObJhtAcXWBaA019XlSwYxMKknfnbXGjKtFOxoyXUYE7cZPh0PRZ2N03xefkynV/C8hW ZbaFySedF2wZlodGDZAylOqSnm9JWkFocXAc4kufB0ldKnBe5rpii5kabL2ne8M7V/pCX6VliDe LGTqKclaKJyz6eHnbSLVgdfYEunD1ZJBJgexoMLpq9rrmLj7Fjy00379G6D8aNCKWpeWggxstlR qsjz+98JNovWGNDJlFS4sqoWD9KhgTxymKg== X-Received: by 2002:a17:903:40d1:b0:2ca:304:f93e with SMTP id d9443c01a7336-2d37ebc2df5mr97346755ad.22.1786640381605; Thu, 13 Aug 2026 09:59:41 -0700 (PDT) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 From: Joas Antonio Date: Thu, 13 Aug 2026 13:59:30 -0300 X-Gm-Features: AUfX_mwucnYyIHD3IqRl-RHeVt6sDZhmNV6nBBs18XEE_p_RDm2X2qFPzlzle-s Message-ID: Subject: [PATCH] ipvs: fix integer overflow in ftp helper port/address parsing To: horms@verge.net.au, ja@ssi.bg, pablo@netfilter.org, fw@strlen.de Cc: netdev@vger.kernel.org, lvs-devel@vger.kernel.org, netfilter-devel@vger.kernel.org, coreteam@netfilter.org, linux-kernel@vger.kernel.org Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" ip_vs_ftp_get_addrport() accumulates decimal digits into a __u16 (hport) and into unsigned char (p[]) without checking for overflow. A crafted FTP PASV/EPSV response with an over-long port or address octet wraps the value, so the helper configures the data connection with a truncated port/address. The netfilter conntrack FTP helper had the same defect, fixed in commit 2b413fc689ba ("netfilter: nf_conntrack_ftp: avoid u16 overflows"). Apply the equivalent fix here: widen the port accumulator to u32 and reject values above 65535, and reject address octets above 255. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: CyberSecurityUP --- net/netfilter/ipvs/ip_vs_ftp.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/net/netfilter/ipvs/ip_vs_ftp.c b/net/netfilter/ipvs/ip_vs_ftp.c index b315c608f..9e3e005a8 100644 --- a/net/netfilter/ipvs/ip_vs_ftp.c +++ b/net/netfilter/ipvs/ip_vs_ftp.c @@ -102,7 +102,7 @@ static int ip_vs_ftp_get_addrport(char *data, char *data_limit, char *s, c; unsigned char p[6]; char edelim; - __u16 hport; + __u32 hport; int i =3D 0; if (data_limit - data < plen) { @@ -144,7 +144,11 @@ static int ip_vs_ftp_get_addrport(char *data, char *data_limit, return -1; c =3D *data; if (isdigit(c)) { - p[i] =3D p[i]*10 + c - '0'; + unsigned int val =3D p[i] * 10 + c - '0'; + + if (val > 255) + return -1; + p[i] =3D val; } else if (c =3D=3D ',' && i < 5) { i++; p[i] =3D 0; @@ -222,6 +226,8 @@ static int ip_vs_ftp_get_addrport(char *data, char *data_limit, if (!isdigit(*s)) break; hport =3D hport * 10 + *s - '0'; + if (hport > 65535) + return -1; } if (s =3D=3D data_limit || !hport || *s !=3D edelim) return -1; -- 2.39.5 (Apple Git-154)