AZL-96003

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nfconntracksip: widen NAT rewrite delta to s32 in siphelptcp()

siphelptcp() stores the size change of each NAT-rewritten SIP message in s16 diff and accumulates it in s16 tdiff, but a single message can grow by more than S16MAX while the packet stays under the 65535 enlargeskb() limit: nfnatsip() rewrites every matching URI, and a long Contact list expands the message by tens of kilobytes. diff then wraps, and "datalen = datalen + diff - msglen" yields a huge unsigned datalen, so the next iteration's ctsipget_header() reads past the linearized skb tail.

Widen diff, tdiff and the seqadjust hook to s32. Both are bounded by the 65535 byte packet limit, and the seqadj core is already s32 (nfctseqadjset() takes s32), so no previously accepted input is rejected.

BUG: KASAN: use-after-free in ctsipgetheader (net/netfilter/nfconntracksip.c:464) Read of size 1 at addr ffff888010800000 by task ksoftirqd/1/25 ctsipgetheader (net/netfilter/nfconntracksip.c:464) siphelptcp (net/netfilter/nfconntracksip.c:1694) nfconfirm (net/netfilter/nfconntrackproto.c:183) nfhookslow (net/netfilter/core.c:619) ip6output (net/ipv6/ip6output.c:246) ip6forward (net/ipv6/ip6output.c:690) ipv6rcv (net/ipv6/ip6_input.c:351) __netifreceiveskbonecore (net/core/dev.c:6212) process_backlog (net/core/dev.c:6676) _napipoll (net/core/dev.c:7735) netrxaction (net/core/dev.c:7955) handlesoftirqs (kernel/softirq.c:622) runksoftirqd (kernel/softirq.c:1076) ...