Merge pull request #1665 from volatilityfoundation/fix_netfilter

Prevent backtraces in netfilter due to smear

volatility3/framework/plugins/linux/netfilter.py

@@ -6,7 +6,7 @@ from abc import ABC, abstractmethod
 import logging
 
 import volatility3.framework.symbols.linux.utilities.modules as linux_utilities_modules
-from typing import Iterator, List, Tuple
+from typing import Iterator, List, Tuple, Optional
 from volatility3 import framework
 from volatility3.framework import (
     constants,
@@ -245,7 +245,9 @@ class AbstractNetfilter(ABC):
             for hook_idx, hook_name in enumerate(proto.hooks):
                 yield proto_idx, proto.name, hook_idx, hook_name
 
-    def build_nf_hook_ops_array(self, nf_hook_entries):
+    def build_nf_hook_ops_array(
+        self, nf_hook_entries
+    ) -> Optional[interfaces.objects.ObjectInterface]:
         """Function helper to build the nf_hook_ops array when it is not part of the
         struct 'nf_hook_entries' definition.
 
@@ -260,16 +262,27 @@ class AbstractNetfilter(ABC):
             }
         """
         nf_hook_entry_size = self.vmlinux.get_type("nf_hook_entry").size
+
+        try:
+            num_hook_entries = nf_hook_entries.num_hook_entries
+        except exceptions.InvalidAddressException:
+            return None
+
         orig_ops_addr = (
-            nf_hook_entries.hooks.vol.offset
-            + nf_hook_entry_size * nf_hook_entries.num_hook_entries
+            nf_hook_entries.hooks.vol.offset + nf_hook_entry_size * num_hook_entries
         )
+
+        if not self.vmlinux._context.layers[self.vmlinux.layer_name].is_valid(
+            orig_ops_addr
+        ):
+            return None
+
         orig_ops = self._context.object(
             object_type=self.get_symbol_fullname("array"),
             offset=orig_ops_addr,
             subtype=self.vmlinux.get_type("pointer"),
             layer_name=self.layer_name,
-            count=nf_hook_entries.num_hook_entries,
+            count=num_hook_entries,
         )
 
         return orig_ops
@@ -515,6 +528,9 @@ class NetfilterImp_4_14_to_4_16(AbstractNetfilter):
 
         nf_hook_ops_name = self.get_symbol_fullname("nf_hook_ops")
         nf_hook_ops_ptr_arr = self.build_nf_hook_ops_array(nf_hook_entries)
+        if not nf_hook_ops_ptr_arr:
+            return
+
         for nf_hook_ops_ptr in nf_hook_ops_ptr_arr:
             nf_hook_ops = nf_hook_ops_ptr.dereference().cast(nf_hook_ops_name)
             yield nf_hook_ops
@@ -695,6 +711,9 @@ class NetfilterNetDevImp_4_14_to_latest(AbstractNetfilterNetDev):
 
         nf_hook_ops_name = self.get_symbol_fullname("nf_hook_ops")
         nf_hook_ops_ptr_arr = self.build_nf_hook_ops_array(nf_hook_entries)
+        if not nf_hook_ops_ptr_arr:
+            return
+
         for nf_hook_ops_ptr in nf_hook_ops_ptr_arr:
             nf_hook_ops = nf_hook_ops_ptr.dereference().cast(nf_hook_ops_name)
             yield nf_hook_ops