Page MenuHomeFreeBSD
Differential D31890

ipsec: Validate the protocol identifier in ipsec4_ctlinput()
ClosedPublic
Actions

Authored by markj on Sep 9 2021, 5:11 PM.
Tags
None
Referenced Files
Unknown Object (File)
Sat, Jul 5, 3:07 PM
Unknown Object (File)
Sat, Jul 5, 10:42 AM
Unknown Object (File)
Wed, Jul 2, 9:30 PM
Unknown Object (File)
Tue, Jul 1, 9:06 AM
Unknown Object (File)
Tue, Jul 1, 8:52 AM
Unknown Object (File)
Tue, Jul 1, 8:37 AM
Unknown Object (File)
Tue, Jul 1, 8:27 AM
Unknown Object (File)
Tue, Jul 1, 8:06 AM
View All 91 Files
Subscribers
ae
imp
melifaro

Details

Reviewers
ae
Commits
rG10eb2a2bde61: ipsec: Validate the protocol identifier in ipsec4_ctlinput()
Summary

key_allocsa() expects to handle only IPSec protocols and has an
assertion to this effect. However, ipsec4_ctlinput() has to handle
messages from ICMP unreachable packets and was not validating the
protocol number. In practice I believe such a packet would simply fail
to match any SADB entries and would thus be ignored.

Reported by: syzbot+6a9ef6fcfadb9f3877fe@syzkaller.appspotmail.com

Diff Detail

Repository
rS FreeBSD src repository - subversion
Lint
Lint Passed
Unit
No Test Coverage
Build Status
Buildable 41446
Build 38335: arc lint + arc unit

Revision Contents
Changeset List

PathSize
sys/
netipsec/
8 lines

Diff 94924

View Options

sys/netipsec/ipsec_input.c

Loading...