Page MenuHomeFreeBSD

ipfilter: Plug ip_nat kernel information leak
ClosedPublic

Authored by cy on Wed, Oct 22, 11:26 PM.
Tags
None
Referenced Files
F133244583: D53274.id164884.diff
Fri, Oct 24, 6:44 AM
F133239013: D53274.diff
Fri, Oct 24, 5:51 AM
F133235838: D53274.id164912.diff
Fri, Oct 24, 5:12 AM
F133219229: D53274.diff
Fri, Oct 24, 2:02 AM
F133214222: D53274.id164884.diff
Fri, Oct 24, 1:10 AM
F133194410: D53274.id164812.diff
Thu, Oct 23, 8:49 PM
F133162241: D53274.id.diff
Thu, Oct 23, 1:18 PM
F133154279: D53274.id164812.diff
Thu, Oct 23, 11:24 AM

Details

Summary

ipf_nat_getent() allocates a variable-sized nat_save_t buffer with
KMALLOCS() (which does not zero memory) and then copies only a subset
of fields into it before returning the object to userland using
ipf_outobjsz(). Because the structure is not fully initialized on all
paths, uninitialized kernel heap bytes can be copied back to user space,
resulting in an information leak.

We fix this by zeroing out the data structure immediately after
allocation.

Reported by: Ilja Van Sprundel <ivansprundel@ioactive.com>
MFC after: 1 day

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Not Applicable
Unit
Tests Not Applicable

Event Timeline

cy requested review of this revision.Wed, Oct 22, 11:26 PM
This revision is now accepted and ready to land.Wed, Oct 22, 11:57 PM
sys/netpfil/ipfilter/netinet/ip_nat.c
1770

This should be done after the null check.

sys/netpfil/ipfilter/netinet/ip_nat.c
1770

Geez. Stupid. Teaches me to rush through things.

cy retitled this revision from ipfilter: Plug kernel information leak to ipfilter: Plug ip_nat kernel information leak.Thu, Oct 23, 3:21 PM
This revision now requires review to proceed.Thu, Oct 23, 3:22 PM
This revision is now accepted and ready to land.Thu, Oct 23, 3:35 PM
This revision was automatically updated to reflect the committed changes.