Skip site navigation (1)Skip section navigation (2)
Date:      Sun, 12 Sep 2021 18:32:48 GMT
From:      Warner Losh <imp@FreeBSD.org>
To:        src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org
Subject:   git: 7a26124388ef - stable/12 - netinet: prevent NULL pointer dereference in in_aifaddr_ioctl()
Message-ID:  <202109121832.18CIWmsl034033@gitrepo.freebsd.org>

next in thread | raw e-mail | index | archive | help
The branch stable/12 has been updated by imp:

URL: https://cgit.FreeBSD.org/src/commit/?id=7a26124388ef3ce76ad7b9d8c45d20f222d73a41

commit 7a26124388ef3ce76ad7b9d8c45d20f222d73a41
Author:     Artem Khramov <akhramov@pm.me>
AuthorDate: 2021-08-24 14:26:35 +0000
Commit:     Warner Losh <imp@FreeBSD.org>
CommitDate: 2021-09-12 16:33:14 +0000

    netinet: prevent NULL pointer dereference in in_aifaddr_ioctl()
    
    It appears that maliciously crafted ifaliasreq can lead to NULL
    pointer dereference in in_aifaddr_ioctl(). In order to replicate
    that, one needs to
    
    1. Ensure that carp(4) is not loaded
    
    2. Issue SIOCAIFADDR call setting ifra_vhid field of the request
       to a negative value.
    
    A repro code would look like this.
    
    int main() {
        struct ifaliasreq req;
        struct sockaddr_in sin, mask;
        int fd, error;
    
        bzero(&sin, sizeof(struct sockaddr_in));
        bzero(&mask, sizeof(struct sockaddr_in));
    
        sin.sin_len = sizeof(struct sockaddr_in);
        sin.sin_family = AF_INET;
        sin.sin_addr.s_addr = inet_addr("192.168.88.2");
    
        mask.sin_len = sizeof(struct sockaddr_in);
        mask.sin_family = AF_INET;
        mask.sin_addr.s_addr = inet_addr("255.255.255.0");
    
        fd = socket(AF_INET, SOCK_DGRAM, 0);
        if (fd < 0)
            return (-1);
    
        memset(&req, 0, sizeof(struct ifaliasreq));
        strlcpy(req.ifra_name, "lo0", sizeof(req.ifra_name));
        memcpy(&req.ifra_addr, &sin, sin.sin_len);
        memcpy(&req.ifra_mask, &mask, mask.sin_len);
        req.ifra_vhid = -1;
    
        return ioctl(fd, SIOCAIFADDR, (char *)&req);
    }
    
    To fix, discard both positive and negative vhid values in
    in_aifaddr_ioctl, if carp(4) is not loaded. This prevents NULL pointer
    dereference and kernel panic.
    
    Reviewed by:    imp@
    Pull Request:   https://github.com/freebsd/freebsd-src/pull/530
    
    (cherry picked from commit 620cf65c2bc4035a07e1152da419a4e60d36ff9b)
---
 sys/netinet/in.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sys/netinet/in.c b/sys/netinet/in.c
index fdcbd318b0c8..788a7d68fd1c 100644
--- a/sys/netinet/in.c
+++ b/sys/netinet/in.c
@@ -369,7 +369,7 @@ in_aifaddr_ioctl(u_long cmd, caddr_t data, struct ifnet *ifp, struct thread *td)
 	    (dstaddr->sin_len != sizeof(struct sockaddr_in) ||
 	     dstaddr->sin_addr.s_addr == INADDR_ANY))
 		return (EDESTADDRREQ);
-	if (vhid > 0 && carp_attach_p == NULL)
+	if (vhid != 0 && carp_attach_p == NULL)
 		return (EPROTONOSUPPORT);
 
 	/*



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?202109121832.18CIWmsl034033>