Skip site navigation (1)Skip section navigation (2) 
Date:      Tue, 1 Dec 2020 19:38:53 +0000 (UTC)
From:      Gordon Tetlow <gordon@FreeBSD.org>
To:        src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-releng@freebsd.org
Subject:   svn commit: r368255 - in releng: 11.4/sys/netinet6 12.1/sys/netinet6 12.2/sys/netinet6
Message-ID:  <202012011938.0B1JcrYo004392@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help 
Author: gordon
Date: Tue Dec  1 19:38:52 2020
New Revision: 368255
URL: https://svnweb.freebsd.org/changeset/base/368255

Log:
  Fix ICMPv6 use-after-free in error message handling.
  
  Approved by:	so
  Security:	FreeBSD-SA-20:31.icmp6
  Security:	CVE-2020-7469

Modified:
  releng/11.4/sys/netinet6/icmp6.c
  releng/12.1/sys/netinet6/icmp6.c
  releng/12.2/sys/netinet6/icmp6.c

Modified: releng/11.4/sys/netinet6/icmp6.c
==============================================================================
--- releng/11.4/sys/netinet6/icmp6.c	Tue Dec  1 19:37:33 2020	(r368254)
+++ releng/11.4/sys/netinet6/icmp6.c	Tue Dec  1 19:38:52 2020	(r368255)
@@ -903,6 +903,7 @@ icmp6_notify_error(struct mbuf **mp, int off, int icmp
 	}
 #endif
 	eip6 = (struct ip6_hdr *)(icmp6 + 1);
+	bzero(&icmp6dst, sizeof(icmp6dst));
 
 	/* Detect the upper level protocol */
 	{
@@ -911,7 +912,6 @@ icmp6_notify_error(struct mbuf **mp, int off, int icmp
 		int eoff = off + sizeof(struct icmp6_hdr) +
 		    sizeof(struct ip6_hdr);
 		struct ip6ctlparam ip6cp;
-		struct in6_addr *finaldst = NULL;
 		int icmp6type = icmp6->icmp6_type;
 		struct ip6_frag *fh;
 		struct ip6_rthdr *rth;
@@ -994,7 +994,7 @@ icmp6_notify_error(struct mbuf **mp, int off, int icmp
 					/* just ignore a bogus header */
 					if ((rth0->ip6r0_len % 2) == 0 &&
 					    (hops = rth0->ip6r0_len/2))
-						finaldst = (struct in6_addr *)(rth0 + 1) + (hops - 1);
+						icmp6dst.sin6_addr = *((struct in6_addr *)(rth0 + 1) + (hops - 1));
 				}
 				eoff += rthlen;
 				nxt = rth->ip6r_nxt;
@@ -1059,13 +1059,10 @@ icmp6_notify_error(struct mbuf **mp, int off, int icmp
 		 */
 		eip6 = (struct ip6_hdr *)(icmp6 + 1);
 
-		bzero(&icmp6dst, sizeof(icmp6dst));
 		icmp6dst.sin6_len = sizeof(struct sockaddr_in6);
 		icmp6dst.sin6_family = AF_INET6;
-		if (finaldst == NULL)
+		if (IN6_IS_ADDR_UNSPECIFIED(&icmp6dst.sin6_addr))
 			icmp6dst.sin6_addr = eip6->ip6_dst;
-		else
-			icmp6dst.sin6_addr = *finaldst;
 		if (in6_setscope(&icmp6dst.sin6_addr, m->m_pkthdr.rcvif, NULL))
 			goto freeit;
 		bzero(&icmp6src, sizeof(icmp6src));
@@ -1077,13 +1074,11 @@ icmp6_notify_error(struct mbuf **mp, int off, int icmp
 		icmp6src.sin6_flowinfo =
 		    (eip6->ip6_flow & IPV6_FLOWLABEL_MASK);
 
-		if (finaldst == NULL)
-			finaldst = &eip6->ip6_dst;
 		ip6cp.ip6c_m = m;
 		ip6cp.ip6c_icmp6 = icmp6;
 		ip6cp.ip6c_ip6 = (struct ip6_hdr *)(icmp6 + 1);
 		ip6cp.ip6c_off = eoff;
-		ip6cp.ip6c_finaldst = finaldst;
+		ip6cp.ip6c_finaldst = &icmp6dst.sin6_addr;
 		ip6cp.ip6c_src = &icmp6src;
 		ip6cp.ip6c_nxt = nxt;
 

Modified: releng/12.1/sys/netinet6/icmp6.c
==============================================================================
--- releng/12.1/sys/netinet6/icmp6.c	Tue Dec  1 19:37:33 2020	(r368254)
+++ releng/12.1/sys/netinet6/icmp6.c	Tue Dec  1 19:38:52 2020	(r368255)
@@ -896,6 +896,7 @@ icmp6_notify_error(struct mbuf **mp, int off, int icmp
 	}
 #endif
 	eip6 = (struct ip6_hdr *)(icmp6 + 1);
+	bzero(&icmp6dst, sizeof(icmp6dst));
 
 	/* Detect the upper level protocol */
 	{
@@ -904,7 +905,6 @@ icmp6_notify_error(struct mbuf **mp, int off, int icmp
 		int eoff = off + sizeof(struct icmp6_hdr) +
 		    sizeof(struct ip6_hdr);
 		struct ip6ctlparam ip6cp;
-		struct in6_addr *finaldst = NULL;
 		int icmp6type = icmp6->icmp6_type;
 		struct ip6_frag *fh;
 		struct ip6_rthdr *rth;
@@ -987,7 +987,7 @@ icmp6_notify_error(struct mbuf **mp, int off, int icmp
 					/* just ignore a bogus header */
 					if ((rth0->ip6r0_len % 2) == 0 &&
 					    (hops = rth0->ip6r0_len/2))
-						finaldst = (struct in6_addr *)(rth0 + 1) + (hops - 1);
+						icmp6dst.sin6_addr = *((struct in6_addr *)(rth0 + 1) + (hops - 1));
 				}
 				eoff += rthlen;
 				nxt = rth->ip6r_nxt;
@@ -1052,13 +1052,10 @@ icmp6_notify_error(struct mbuf **mp, int off, int icmp
 		 */
 		eip6 = (struct ip6_hdr *)(icmp6 + 1);
 
-		bzero(&icmp6dst, sizeof(icmp6dst));
 		icmp6dst.sin6_len = sizeof(struct sockaddr_in6);
 		icmp6dst.sin6_family = AF_INET6;
-		if (finaldst == NULL)
+		if (IN6_IS_ADDR_UNSPECIFIED(&icmp6dst.sin6_addr))
 			icmp6dst.sin6_addr = eip6->ip6_dst;
-		else
-			icmp6dst.sin6_addr = *finaldst;
 		if (in6_setscope(&icmp6dst.sin6_addr, m->m_pkthdr.rcvif, NULL))
 			goto freeit;
 		bzero(&icmp6src, sizeof(icmp6src));
@@ -1070,13 +1067,11 @@ icmp6_notify_error(struct mbuf **mp, int off, int icmp
 		icmp6src.sin6_flowinfo =
 		    (eip6->ip6_flow & IPV6_FLOWLABEL_MASK);
 
-		if (finaldst == NULL)
-			finaldst = &eip6->ip6_dst;
 		ip6cp.ip6c_m = m;
 		ip6cp.ip6c_icmp6 = icmp6;
 		ip6cp.ip6c_ip6 = (struct ip6_hdr *)(icmp6 + 1);
 		ip6cp.ip6c_off = eoff;
-		ip6cp.ip6c_finaldst = finaldst;
+		ip6cp.ip6c_finaldst = &icmp6dst.sin6_addr;
 		ip6cp.ip6c_src = &icmp6src;
 		ip6cp.ip6c_nxt = nxt;
 

Modified: releng/12.2/sys/netinet6/icmp6.c
==============================================================================
--- releng/12.2/sys/netinet6/icmp6.c	Tue Dec  1 19:37:33 2020	(r368254)
+++ releng/12.2/sys/netinet6/icmp6.c	Tue Dec  1 19:38:52 2020	(r368255)
@@ -912,6 +912,7 @@ icmp6_notify_error(struct mbuf **mp, int off, int icmp
 	}
 	icmp6 = (struct icmp6_hdr *)(mtod(m, caddr_t) + off);
 	eip6 = (struct ip6_hdr *)(icmp6 + 1);
+	bzero(&icmp6dst, sizeof(icmp6dst));
 
 	/* Detect the upper level protocol */
 	{
@@ -920,7 +921,6 @@ icmp6_notify_error(struct mbuf **mp, int off, int icmp
 		int eoff = off + sizeof(struct icmp6_hdr) +
 		    sizeof(struct ip6_hdr);
 		struct ip6ctlparam ip6cp;
-		struct in6_addr *finaldst = NULL;
 		int icmp6type = icmp6->icmp6_type;
 		struct ip6_frag *fh;
 		struct ip6_rthdr *rth;
@@ -994,10 +994,11 @@ icmp6_notify_error(struct mbuf **mp, int off, int icmp
 					}
 					rth0 = (struct ip6_rthdr0 *)
 					    (mtod(m, caddr_t) + eoff);
+
 					/* just ignore a bogus header */
 					if ((rth0->ip6r0_len % 2) == 0 &&
 					    (hops = rth0->ip6r0_len/2))
-						finaldst = (struct in6_addr *)(rth0 + 1) + (hops - 1);
+						icmp6dst.sin6_addr = *((struct in6_addr *)(rth0 + 1) + (hops - 1));
 				}
 				eoff += rthlen;
 				nxt = rth->ip6r_nxt;
@@ -1051,13 +1052,10 @@ icmp6_notify_error(struct mbuf **mp, int off, int icmp
 		 */
 		eip6 = (struct ip6_hdr *)(icmp6 + 1);
 
-		bzero(&icmp6dst, sizeof(icmp6dst));
 		icmp6dst.sin6_len = sizeof(struct sockaddr_in6);
 		icmp6dst.sin6_family = AF_INET6;
-		if (finaldst == NULL)
+		if (IN6_IS_ADDR_UNSPECIFIED(&icmp6dst.sin6_addr))
 			icmp6dst.sin6_addr = eip6->ip6_dst;
-		else
-			icmp6dst.sin6_addr = *finaldst;
 		if (in6_setscope(&icmp6dst.sin6_addr, m->m_pkthdr.rcvif, NULL))
 			goto freeit;
 		bzero(&icmp6src, sizeof(icmp6src));
@@ -1069,13 +1067,11 @@ icmp6_notify_error(struct mbuf **mp, int off, int icmp
 		icmp6src.sin6_flowinfo =
 		    (eip6->ip6_flow & IPV6_FLOWLABEL_MASK);
 
-		if (finaldst == NULL)
-			finaldst = &eip6->ip6_dst;
 		ip6cp.ip6c_m = m;
 		ip6cp.ip6c_icmp6 = icmp6;
 		ip6cp.ip6c_ip6 = (struct ip6_hdr *)(icmp6 + 1);
 		ip6cp.ip6c_off = eoff;
-		ip6cp.ip6c_finaldst = finaldst;
+		ip6cp.ip6c_finaldst = &icmp6dst.sin6_addr;
 		ip6cp.ip6c_src = &icmp6src;
 		ip6cp.ip6c_nxt = nxt;

Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?202012011938.0B1JcrYo004392>