Page MenuHomeFreeBSD

ipsec esp: avoid dereferencing freed secasindex
ClosedPublic

Authored by kib on Feb 25 2024, 10:37 AM.
Tags
None
Referenced Files
Unknown Object (File)
Thu, May 9, 7:39 PM
Unknown Object (File)
Thu, May 9, 3:47 AM
Unknown Object (File)
Wed, May 1, 8:44 AM
Unknown Object (File)
Fri, Apr 26, 3:42 AM
Unknown Object (File)
Apr 19 2024, 7:29 PM
Unknown Object (File)
Apr 19 2024, 4:57 AM
Unknown Object (File)
Apr 12 2024, 8:48 PM
Unknown Object (File)
Apr 9 2024, 2:51 AM

Details

Summary
It is possible that SA was removed while processing packed, in which
case it changed to the DEAD state and it index removed from the tree.
Dereferencing sav->sah then touches freed memory.

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Not Applicable
Unit
Tests Not Applicable

Event Timeline

kib requested review of this revision.Feb 25 2024, 10:37 AM

Probably we should increase esps_notdb or esps_invalid counter here.

This revision is now accepted and ready to land.Feb 26 2024, 7:40 AM

Update counter, add debug printf for the situation.

This revision now requires review to proceed.Feb 26 2024, 10:04 AM
This revision is now accepted and ready to land.Feb 26 2024, 2:17 PM
This revision was automatically updated to reflect the committed changes.