Page MenuHomeFreeBSD

Limit option_len for the TCP_CCALGOOPT option
ClosedPublic

Authored by tuexen on Nov 28 2018, 10:44 AM.
Tags
None
Referenced Files
Unknown Object (File)
Thu, Oct 2, 9:38 AM
Unknown Object (File)
Sun, Sep 28, 9:47 AM
Unknown Object (File)
Sat, Sep 27, 4:34 AM
Unknown Object (File)
Fri, Sep 26, 7:47 PM
Unknown Object (File)
Fri, Sep 26, 7:34 PM
Unknown Object (File)
Fri, Sep 26, 7:34 PM
Unknown Object (File)
Sun, Sep 14, 2:08 AM
Unknown Object (File)
Sep 5 2025, 2:00 AM
Subscribers

Details

Summary

When processing the IPPROTO_TCP level socket option TCP_CCALGOOPT, the kernel allocates memory based on the user provided option_len parameter. This option is currently only used by the newreno CC module, where the size used is 8 bytes.

This patch limits the size of allocated memory to 2048 bytes.

This issue was found by using syzkaller.

Diff Detail

Repository
rS FreeBSD src repository - subversion
Lint
Lint Not Applicable
Unit
Tests Not Applicable