Page MenuHomeFreeBSD

Limit option_len for the TCP_CCALGOOPT option
ClosedPublic

Authored by tuexen on Nov 28 2018, 10:44 AM.
Tags
None
Referenced Files
Unknown Object (File)
Tue, Mar 19, 8:51 PM
Unknown Object (File)
Dec 22 2023, 10:09 PM
Unknown Object (File)
Dec 10 2023, 6:06 PM
Unknown Object (File)
Nov 12 2023, 5:42 PM
Unknown Object (File)
Oct 25 2023, 9:48 AM
Unknown Object (File)
Oct 22 2023, 6:30 AM
Unknown Object (File)
Oct 10 2023, 6:05 PM
Unknown Object (File)
Sep 7 2023, 3:42 PM
Subscribers

Details

Summary

When processing the IPPROTO_TCP level socket option TCP_CCALGOOPT, the kernel allocates memory based on the user provided option_len parameter. This option is currently only used by the newreno CC module, where the size used is 8 bytes.

This patch limits the size of allocated memory to 2048 bytes.

This issue was found by using syzkaller.

Diff Detail

Repository
rS FreeBSD src repository - subversion
Lint
Lint Skipped
Unit
Tests Skipped
Build Status
Buildable 21237