From 66f0f3a599ed6c6b8b8dbb8140ef34591db1740e Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Tue, 23 Jun 2026 17:47:50 +0200 Subject: [PATCH] kernel-netlink: Add some safety checks when printing extended error messages The previous code could potentially cause out-of-bound reads. Fixes: 7988aea7d80a ("kernel-netlink: Log extended ACK error/warning messages") --- .../kernel_netlink/kernel_netlink_shared.c | 19 ++++++++++++++++++- 1 file changed, 18 insertions(+), 1 deletion(-) diff --git a/src/libcharon/plugins/kernel_netlink/kernel_netlink_shared.c b/src/libcharon/plugins/kernel_netlink/kernel_netlink_shared.c index 339d0b9e6..a38f6bd8a 100644 --- a/src/libcharon/plugins/kernel_netlink/kernel_netlink_shared.c +++ b/src/libcharon/plugins/kernel_netlink/kernel_netlink_shared.c @@ -920,8 +920,16 @@ void netlink_log_error(struct nlmsghdr *hdr, const char *prefix) struct rtattr *rta; size_t offset, rtasize; const char *msg = NULL; - bool is_error = err->error != 0; + bool is_error; + if (hdr->nlmsg_len < NLMSG_LENGTH(sizeof(*err))) + { + DBG1(DBG_KNL, "%s%sreceived truncated netlink error/warning", + prefix ? prefix : "", prefix ? ": " : ""); + return; + } + + is_error = err->error != 0; if (!prefix) { prefix = is_error ? "received netlink error" @@ -935,7 +943,15 @@ void netlink_log_error(struct nlmsghdr *hdr, const char *prefix) offset = sizeof(*err); if (!(hdr->nlmsg_flags & NLM_F_CAPPED)) { + if (err->msg.nlmsg_len < NLMSG_HDRLEN) + { + goto log; + } offset += err->msg.nlmsg_len - NLMSG_HDRLEN; + if (NLMSG_SPACE(offset) > hdr->nlmsg_len) + { + goto log; + } } rta = (struct rtattr*)(NLMSG_DATA(hdr) + NLMSG_ALIGN(offset)); @@ -956,6 +972,7 @@ void netlink_log_error(struct nlmsghdr *hdr, const char *prefix) } } +log: if (msg && *msg) { if (is_error)