Subject: Re: [PATCH net] netfilter: ctnetlink: validate CTA_EXPECT_NAT_DIR to prevent OOB access

From: Florian Westphal <[email-masked]>
Date: Sat, 7 Mar 2026 19:01:07 +0100

Hyunwoo Kim <[email-masked]> wrote:
> ctnetlink_parse_expect_nat() assigns the user-supplied
> CTA_EXPECT_NAT_DIR value directly to exp->dir without validating that it
> is within the valid range (0 to IP_CT_DIR_MAX-1).  When
> nf_nat_sip_expected() later uses exp->dir as an index into
> ct->master->tuplehash[], an out-of-bounds array access occurs.
> 
> For example, with exp->dir = 100, the access at
> ct->master->tuplehash[100] reads 5600 bytes past the start of a
> 320-byte nf_conn object, causing a slab-out-of-bounds read confirmed by
> UBSAN.
> 
> Validate exp->dir against IP_CT_DIR_MAX before accepting it.

I would prefer a fix for exp_nat_nla_policy so netlink policy validation
can handle this for us.

        [CTA_EXPECT_NAT_DIR] = NLA_POLICY_MAX(NLA_BE32, IPCT_DIR_MAX),

.. should do it.  Might make sense to check all other attrs while at it.