Page MenuHomeFreeBSD

ipsec: Validate the protocol identifier in ipsec4_ctlinput()
ClosedPublic

Authored by markj on Sep 9 2021, 5:11 PM.
Tags
None
Referenced Files
Unknown Object (File)
Sun, Feb 9, 9:52 PM
Unknown Object (File)
Sat, Feb 1, 5:35 AM
Unknown Object (File)
Jan 16 2025, 1:05 AM
Unknown Object (File)
Jan 16 2025, 12:00 AM
Unknown Object (File)
Jan 15 2025, 9:50 PM
Unknown Object (File)
Jan 12 2025, 2:34 AM
Unknown Object (File)
Dec 28 2024, 10:32 PM
Unknown Object (File)
Dec 27 2024, 11:58 AM
Subscribers

Details

Summary

key_allocsa() expects to handle only IPSec protocols and has an
assertion to this effect. However, ipsec4_ctlinput() has to handle
messages from ICMP unreachable packets and was not validating the
protocol number. In practice I believe such a packet would simply fail
to match any SADB entries and would thus be ignored.

Reported by: syzbot+6a9ef6fcfadb9f3877fe@syzkaller.appspotmail.com

Diff Detail

Repository
rS FreeBSD src repository - subversion
Lint
Lint Passed
Unit
No Test Coverage
Build Status
Buildable 41446
Build 38335: arc lint + arc unit