238787 2019-06-24 11:51:47 +0000 IPv6 remote DoS (panic) vulnerability via m_pulldown() bug 2019-11-13 01:49:54 +0000 1 1 1 Unclassified Base System kern CURRENT Any Any Closed FIXED https://gnats.netbsd.org/30098 crash, security Normal Affects Many People --- 1 crest jtl bz chris emaste gnn jtl koobs secteam sigsys oldest_to_newest 1055422 0 crest 2019-06-24 11:51:47 +0000 A bug supposedly reported years ago is still unfixed in FreeBSD according to this post from a few hours ago: https://www.reddit.com/r/BSD/comments/c4krwr/freebsd_ipv6_remote_dingdong_attack_kernel_panic/?ref=share&ref_source=link archived at: https://web.archive.org/web/20190624115041/https://www.reddit.com/r/BSD/comments/c4krwr/freebsd_ipv6_remote_dingdong_attack_kernel_panic/?ref=share&ref_source=link. 1055423 1 linimon 2019-06-24 11:56:34 +0000 Fix assignment. Hadn't had enough caffeine yet. 1055424 2 koobs 2019-06-24 12:06:46 +0000 Could not find references for "reported to and publicly acknowledged by FreeBSD in 2006". If any existing bug exists, please close this as a duplicate of that and retriage that one. 1055426 3 crest 2019-06-24 12:14:14 +0000 I haven't found an open PR with crashes in m_pulldown which is why I created a new PR instead of adding a comment to the existing report, but if the message was send to the security team and got dropped as the reddit post implies there might not be any publicly visible PR for it. Now that the report was posted in a public forum any further discussion should probably happen in the open as well. 1055430 4 koobs 2019-06-24 13:02:28 +0000 OpenBSD Commit: https://github.com/openbsd/src/commit/993ebdb685a594e5fe7427998c1025b419e85db6 1055433 5 emaste 2019-06-24 13:48:10 +0000 NetBSD bug report and analysis: http://gnats.netbsd.org/30098 1060905 6 emaste 2019-08-08 04:03:25 +0000 NetBSD change: https://github.com/NetBSD/src/commit/1f94be1791b90c41bfadc9b0aa0621df55213659 XNU change: https://github.com/apple/darwin-xnu/commit/5bbb823c13f3ab1ab58878f96b35433a29882676 1061152 7 commit-hook 2019-08-09 05:20:00 +0000 A commit references this bug: Author: jtl Date: Fri Aug 9 05:19:00 UTC 2019 New revision: 350815 URL: https://svnweb.freebsd.org/changeset/base/350815 Log: In m_pulldown(), before trying to prepend bytes to the subsequent mbuf, ensure that the subsequent mbuf contains the remainder of the bytes the caller sought. If this is not the case, fall through to the code which gathers the bytes in a new mbuf. This fixes a bug where m_pulldown() could fail to gather all the desired bytes into consecutive memory. PR: 238787 Reported by: A reddit user Discussed with: emaste Obtained from: NetBSD MFC after: 3 days Changes: head/sys/kern/uipc_mbuf2.c 1061154 8 jtl 2019-08-09 05:22:38 +0000 I was able to replicate the crash. The fix from NetBSD fixed the crash. After discussing it with emaste@, I committed the fix to head. 1061207 9 crest 2019-08-09 11:32:05 +0000 Why wasn't the reddit user named by his/her nickname as "TheGrandSchlonging"? 1061211 10 emaste 2019-08-09 12:03:00 +0000 Because they've said in the past > nor do I want "TheGrandSchlonging" to appear in FreeBSD commit logs 1061212 11 koobs 2019-08-09 12:17:10 +0000 Assign to committer resolving (keep secteam CC'd) 1061271 12 commit-hook 2019-08-10 00:01:29 +0000 A commit references this bug: Author: jtl Date: Sat Aug 10 00:01:26 UTC 2019 New revision: 350828 URL: https://svnweb.freebsd.org/changeset/base/350828 Log: MFC r350815: In m_pulldown(), before trying to prepend bytes to the subsequent mbuf, ensure that the subsequent mbuf contains the remainder of the bytes the caller sought. If this is not the case, fall through to the code which gathers the bytes in a new mbuf. This fixes a bug where m_pulldown() could fail to gather all the desired bytes into consecutive memory. PR: 238787 Approved by: so (emaste) Changes: _U stable/12/ stable/12/sys/kern/uipc_mbuf2.c 1061272 13 commit-hook 2019-08-10 00:03:32 +0000 A commit references this bug: Author: jtl Date: Sat Aug 10 00:02:46 UTC 2019 New revision: 350829 URL: https://svnweb.freebsd.org/changeset/base/350829 Log: MFC r350815: In m_pulldown(), before trying to prepend bytes to the subsequent mbuf, ensure that the subsequent mbuf contains the remainder of the bytes the caller sought. If this is not the case, fall through to the code which gathers the bytes in a new mbuf. This fixes a bug where m_pulldown() could fail to gather all the desired bytes into consecutive memory. PR: 238787 Approved by: so (emaste) Changes: _U stable/11/ stable/11/sys/kern/uipc_mbuf2.c 1061855 14 emaste 2019-08-13 20:54:09 +0000 Original report can be found at http://web.archive.org/web/20091116125618/clem1.be/gimme/ipv6sec.pdf 1075112 15 bz 2019-11-12 22:19:03 +0000 This was published as FreeBSD-SA-19:22.mbuf and with that I assume can be closed. 1075127 16 koobs 2019-11-13 01:49:54 +0000 ^Triage: Track merge status