Created attachment 224935 [details] assigning the new allocated *prtm to rtm Bug File: sys/net/rtsock.c In function update_rtm_from_rc, *prtm is assigned to rtm at line 946 and the *prtm is freed by callee update_rtm_from_info() via free(orig_rtm, M_TEMP). And then *prim was assigned with a new allocated rtm in this callee. But now, the rtm in the caller still points to a freed memory object. The freed memory object is used later by rtm->rtm_flags, rtm->rtm_rmx and rtm->rtm_rmx.rmx_weight... The root of this uaf bug is reassignment of *prim in callee does not change the value of outside rtm. My patch fixs this error by assigning the new allocated *prtm to rtm.
A commit in branch main references this bug: URL: https://cgit.FreeBSD.org/src/commit/?id=76cfc6fa0d819e7caca86c8299947cea1af9d6bc commit 76cfc6fa0d819e7caca86c8299947cea1af9d6bc Author: Alexander V. Chernikov <melifaro@FreeBSD.org> AuthorDate: 2021-05-14 16:03:08 +0000 Commit: Alexander V. Chernikov <melifaro@FreeBSD.org> CommitDate: 2021-05-14 16:06:41 +0000 Fix a use after free in update_rtm_from_rc(). update_rtm_from_rc() calls update_rtm_from_info() internally. The latter one may update provided prtm pointer with a new rtm. Reassign rtm from prtm afeter calling update_rtm_from_info() to avoid touching the freed rtm. PR: 255871 Submitted by: lylgood@foxmail.com MFC after: 3 days sys/net/rtsock.c | 1 + 1 file changed, 1 insertion(+)
A commit in branch stable/13 references this bug: URL: https://cgit.FreeBSD.org/src/commit/?id=d40def01a4f4fed65329f4a74792cad3134eeb29 commit d40def01a4f4fed65329f4a74792cad3134eeb29 Author: Alexander V. Chernikov <melifaro@FreeBSD.org> AuthorDate: 2021-05-14 16:03:08 +0000 Commit: Alexander V. Chernikov <melifaro@FreeBSD.org> CommitDate: 2021-05-30 10:30:53 +0000 Fix a use after free in update_rtm_from_rc(). update_rtm_from_rc() calls update_rtm_from_info() internally. The latter one may update provided prtm pointer with a new rtm. Reassign rtm from prtm afeter calling update_rtm_from_info() to avoid touching the freed rtm. PR: 255871 Submitted by: lylgood@foxmail.com sys/net/rtsock.c | 1 + 1 file changed, 1 insertion(+)