255871 2021-05-14 12:22:02 +0000 net/rtsock: Fix a use after free in update_rtm_from_rc 2021-06-16 14:36:35 +0000 1 1 1 Unclassified Base System kern CURRENT Any Any Closed FIXED --- Affects Many People --- 1 lylgood melifaro markj melifaro net oldest_to_newest 1161307 0 224935 lylgood 2021-05-14 12:22:02 +0000 Created attachment 224935 assigning the new allocated *prtm to rtm Bug File: sys/net/rtsock.c In function update_rtm_from_rc, *prtm is assigned to rtm at line 946 and the *prtm is freed by callee update_rtm_from_info() via free(orig_rtm, M_TEMP). And then *prim was assigned with a new allocated rtm in this callee. But now, the rtm in the caller still points to a freed memory object. The freed memory object is used later by rtm->rtm_flags, rtm->rtm_rmx and rtm->rtm_rmx.rmx_weight... The root of this uaf bug is reassignment of *prim in callee does not change the value of outside rtm. My patch fixs this error by assigning the new allocated *prtm to rtm. 1161366 1 commit-hook 2021-05-14 16:11:20 +0000 A commit in branch main references this bug: URL: https://cgit.FreeBSD.org/src/commit/?id=76cfc6fa0d819e7caca86c8299947cea1af9d6bc commit 76cfc6fa0d819e7caca86c8299947cea1af9d6bc Author: Alexander V. Chernikov <melifaro@FreeBSD.org> AuthorDate: 2021-05-14 16:03:08 +0000 Commit: Alexander V. Chernikov <melifaro@FreeBSD.org> CommitDate: 2021-05-14 16:06:41 +0000 Fix a use after free in update_rtm_from_rc(). update_rtm_from_rc() calls update_rtm_from_info() internally. The latter one may update provided prtm pointer with a new rtm. Reassign rtm from prtm afeter calling update_rtm_from_info() to avoid touching the freed rtm. PR: 255871 Submitted by: lylgood@foxmail.com MFC after: 3 days sys/net/rtsock.c | 1 + 1 file changed, 1 insertion(+) 1163760 2 commit-hook 2021-05-30 10:31:23 +0000 A commit in branch stable/13 references this bug: URL: https://cgit.FreeBSD.org/src/commit/?id=d40def01a4f4fed65329f4a74792cad3134eeb29 commit d40def01a4f4fed65329f4a74792cad3134eeb29 Author: Alexander V. Chernikov <melifaro@FreeBSD.org> AuthorDate: 2021-05-14 16:03:08 +0000 Commit: Alexander V. Chernikov <melifaro@FreeBSD.org> CommitDate: 2021-05-30 10:30:53 +0000 Fix a use after free in update_rtm_from_rc(). update_rtm_from_rc() calls update_rtm_from_info() internally. The latter one may update provided prtm pointer with a new rtm. Reassign rtm from prtm afeter calling update_rtm_from_info() to avoid touching the freed rtm. PR: 255871 Submitted by: lylgood@foxmail.com sys/net/rtsock.c | 1 + 1 file changed, 1 insertion(+) 224935 2021-05-14 12:22:02 +0000 2021-05-14 12:22:02 +0000 assigning the new allocated *prtm to rtm 0001-net-uaf-update_rtm_from_rc.patch text/plain 468 lylgood ZGlmZiAtLWdpdCBhL3N5cy9uZXQvcnRzb2NrLmMgYi9zeXMvbmV0L3J0c29jay5jCmluZGV4IDY5 MzBiZDE2N2FjMS4uM2NiNjQ1ZjQyZTRjIDEwMDY0NAotLS0gYS9zeXMvbmV0L3J0c29jay5jCisr KyBiL3N5cy9uZXQvcnRzb2NrLmMKQEAgLTk3Niw2ICs5NzYsNyBAQCB1cGRhdGVfcnRtX2Zyb21f cmMoc3RydWN0IHJ0X2FkZHJpbmZvICppbmZvLCBzdHJ1Y3QgcnRfbXNnaGRyICoqcHJ0bSwKIAlp ZiAoKGVycm9yID0gdXBkYXRlX3J0bV9mcm9tX2luZm8oaW5mbywgcHJ0bSwgYWxsb2NfbGVuKSkg IT0gMCkKIAkJcmV0dXJuIChlcnJvcik7CiAKKwlydG0gPSAqcHJ0bTsKIAlydG0tPnJ0bV9mbGFn cyA9IHJjLT5yY19ydC0+cnRlX2ZsYWdzIHwgbmhvcF9nZXRfcnRmbGFncyhuaCk7CiAJaWYgKHJ0 bS0+cnRtX2ZsYWdzICYgUlRGX0dXRkxBR19DT01QQVQpCiAJCXJ0bS0+cnRtX2ZsYWdzID0gUlRG X0dBVEVXQVkgfCAK