Date: Thu, 19 Mar 2020 16:46:02 +0000 (UTC) From: Gordon Tetlow <gordon@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-releng@freebsd.org Subject: svn commit: r359138 - in releng: 11.3/sys/netinet 12.1/sys/netinet Message-ID: <202003191646.02JGk2MG024329@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: gordon Date: Thu Mar 19 16:46:01 2020 New Revision: 359138 URL: https://svnweb.freebsd.org/changeset/base/359138 Log: Fix TCP IPv6 SYN cache kernel information disclosure. Approved by: so Security: FreeBSD-SA-20:04.tcp Security: CVE-2020-7451 Modified: releng/11.3/sys/netinet/tcp_syncache.c releng/12.1/sys/netinet/tcp_syncache.c Modified: releng/11.3/sys/netinet/tcp_syncache.c ============================================================================== --- releng/11.3/sys/netinet/tcp_syncache.c Thu Mar 19 16:43:37 2020 (r359137) +++ releng/11.3/sys/netinet/tcp_syncache.c Thu Mar 19 16:46:01 2020 (r359138) @@ -1679,7 +1679,8 @@ syncache_respond(struct syncache *sc, struct syncache_ ip6->ip6_dst = sc->sc_inc.inc6_faddr; ip6->ip6_plen = htons(tlen - hlen); /* ip6_hlim is set after checksum */ - ip6->ip6_flow &= ~IPV6_FLOWLABEL_MASK; + /* Zero out traffic class and flow label. */ + ip6->ip6_flow &= ~IPV6_FLOWINFO_MASK; ip6->ip6_flow |= sc->sc_flowlabel; th = (struct tcphdr *)(ip6 + 1); Modified: releng/12.1/sys/netinet/tcp_syncache.c ============================================================================== --- releng/12.1/sys/netinet/tcp_syncache.c Thu Mar 19 16:43:37 2020 (r359137) +++ releng/12.1/sys/netinet/tcp_syncache.c Thu Mar 19 16:46:01 2020 (r359138) @@ -1728,7 +1728,8 @@ syncache_respond(struct syncache *sc, struct syncache_ ip6->ip6_dst = sc->sc_inc.inc6_faddr; ip6->ip6_plen = htons(tlen - hlen); /* ip6_hlim is set after checksum */ - ip6->ip6_flow &= ~IPV6_FLOWLABEL_MASK; + /* Zero out traffic class and flow label. */ + ip6->ip6_flow &= ~IPV6_FLOWINFO_MASK; ip6->ip6_flow |= sc->sc_flowlabel; th = (struct tcphdr *)(ip6 + 1);
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?202003191646.02JGk2MG024329>