Page MenuHomeFreeBSD
Differential D11796

Do stricter checks in the msg2sp() function
ClosedPublic
Actions

Authored by ae on Jul 31 2017, 4:44 PM.
Tags
None
Referenced Files
Unknown Object (File)
Nov 29 2025, 10:21 AM
Unknown Object (File)
Nov 15 2025, 11:58 PM
Unknown Object (File)
Nov 10 2025, 12:50 AM
Unknown Object (File)
Nov 5 2025, 2:09 PM
Unknown Object (File)
Nov 5 2025, 2:09 PM
Unknown Object (File)
Nov 5 2025, 2:09 PM
Unknown Object (File)
Nov 5 2025, 11:42 AM
Unknown Object (File)
Oct 31 2025, 12:49 PM
View All 71 Files
Subscribers
imp

Details

Reviewers
bz
gnn
des
Commits
rS322328: Make user supplied data checks a bit stricter.
Summary

This patch should fix the IPsec related problem described in the DEFCON-25-Ilja-van-Sprundel-BSD-Kern-Vulns.pdf

Actually, this IP[V6]_IPSEC_POLICY socket option is available only for privileged user, and when you are root user, you have many much easiest ways to crash the system. But anyway it is better to fix it.

Diff Detail

Repository
rS FreeBSD src repository - subversion
Lint
Lint Not Applicable
Unit
Tests Not Applicable

Event Timeline

ae created this revision.Jul 31 2017, 4:44 PM
Herald added a subscriber: imp. · View Herald TranscriptJul 31 2017, 4:44 PM
Closed by commit rS322328: Make user supplied data checks a bit stricter. (authored by ae). · Explain WhyAug 9 2017, 7:58 PM
This revision was automatically updated to reflect the committed changes.

Revision Contents
Changeset List

PathSize
head/
sys/
netipsec/
26 lines

Diff 31829

View Options

head/sys/netipsec/key.c

Loading...