Page MenuHomeFreeBSD

ipsec: Validate the protocol identifier in ipsec4_ctlinput()
ClosedPublic

Authored by markj on Thu, Sep 9, 5:11 PM.

Details

Summary

key_allocsa() expects to handle only IPSec protocols and has an
assertion to this effect. However, ipsec4_ctlinput() has to handle
messages from ICMP unreachable packets and was not validating the
protocol number. In practice I believe such a packet would simply fail
to match any SADB entries and would thus be ignored.

Reported by: syzbot+6a9ef6fcfadb9f3877fe@syzkaller.appspotmail.com

Diff Detail

Repository
R10 FreeBSD src repository
Lint
Automatic diff as part of commit; lint not applicable.
Unit
Automatic diff as part of commit; unit tests not applicable.