Page MenuHomeFreeBSD

Limit option_len for the TCP_CCALGOOPT option
ClosedPublic

Authored by tuexen on Nov 28 2018, 10:44 AM.
Tags
None
Referenced Files
Unknown Object (File)
Fri, Jan 17, 7:27 PM
Unknown Object (File)
Thu, Jan 9, 5:21 AM
Unknown Object (File)
Dec 25 2024, 4:12 PM
Unknown Object (File)
Dec 23 2024, 11:15 PM
Unknown Object (File)
Dec 22 2024, 7:58 PM
Unknown Object (File)
Dec 7 2024, 6:16 AM
Unknown Object (File)
Dec 4 2024, 11:52 PM
Unknown Object (File)
Nov 24 2024, 7:48 PM
Subscribers

Details

Summary

When processing the IPPROTO_TCP level socket option TCP_CCALGOOPT, the kernel allocates memory based on the user provided option_len parameter. This option is currently only used by the newreno CC module, where the size used is 8 bytes.

This patch limits the size of allocated memory to 2048 bytes.

This issue was found by using syzkaller.

Diff Detail

Repository
rS FreeBSD src repository - subversion
Lint
Lint Not Applicable
Unit
Tests Not Applicable