Bug 297264 - Exploitable bug in PF_KEY?
Summary: Exploitable bug in PF_KEY?
Status: Closed FIXED
Alias: None
Product: Base System
Classification: Unclassified
Component: kern (show other bugs)
Version: 15.1-RELEASE
Hardware: Any Any
: --- Affects Some People
Assignee: Konstantin Belousov
URL:
Keywords: security
Depends on:
Blocks:
 
Reported: 2026-08-04 09:23 UTC by Ricardo Branco
Modified: 2026-08-18 01:28 UTC (History)
9 users (show)

See Also:
linimon: mfc-stable14?


Attachments
patch suggested by Claude Sonnet 5.0 (1.21 KB, patch)
2026-08-04 09:28 UTC, Ricardo Branco
no flags Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Ricardo Branco 2026-08-04 09:23:41 UTC
This account has published known LPEs and this one is recent:

https://github.com/0xdeadbeefnetwork/pfkey-sadb-overflow

Found via his X account: https://x.com/encrypted_past/status/2084448644460130572
Comment 1 Ricardo Branco 2026-08-04 09:28:57 UTC
Created attachment 273436 [details]
patch suggested by Claude Sonnet 5.0
Comment 2 Kristof Provost freebsd_committer freebsd_triage 2026-08-04 13:34:37 UTC
Mark, this is about IPSec code, not pf.
Comment 3 Konstantin Belousov freebsd_committer freebsd_triage 2026-08-04 15:56:35 UTC
The pfkey_lpe sample does not work for me.
But I think that the issue is real, https://reviews.freebsd.org/D58646
Comment 4 Ricardo Branco 2026-08-04 19:40:46 UTC
Blog entry:
https://afflicted.sh/blog/posts/pfkey-sa-len-overflow.html
Comment 5 commit-hook freebsd_committer freebsd_triage 2026-08-14 14:37:02 UTC
A commit in branch main references this bug:

URL: https://cgit.FreeBSD.org/src/commit/?id=cba481a7bff2fcf31420ee8b2714660e2666452b

commit cba481a7bff2fcf31420ee8b2714660e2666452b
Author:     Konstantin Belousov <kib@FreeBSD.org>
AuthorDate: 2026-08-04 15:52:53 +0000
Commit:     Konstantin Belousov <kib@FreeBSD.org>
CommitDate: 2026-08-14 14:35:38 +0000

    PF_KEY socket: limit the length of copied socket address

    for SADB_UPDATE op SADB_X_EXT_NEW_ADDRESS_SRC/DST extensions, by
    checking the sa_len matching the address family requirements before
    doing the copy.

    Also convert KEY_SETSECASIDX() and KEY_SETSECSPIDX() to functions and
    apply the sa_len clamping there.

    See https://github.com/0xdeadbeefnetwork/pfkey-sadb-overflow

    PR:     297264
    Tested by:      Wafa Hamzah <wafah@nvidia.com> (previous version)
    Reviewed by:    markj
    Sponsored by:   The FreeBSD Foundation
    MFC after:      1 week
    Differential revision:  https://reviews.freebsd.org/D58646

 sys/netipsec/key.c | 128 +++++++++++++++++++++++++++++------------------------
 1 file changed, 69 insertions(+), 59 deletions(-)
Comment 6 commit-hook freebsd_committer freebsd_triage 2026-08-16 02:48:13 UTC
A commit in branch stable/15 references this bug:

URL: https://cgit.FreeBSD.org/src/commit/?id=fffaf471280bf6f9e73603d84361a101e1160330

commit fffaf471280bf6f9e73603d84361a101e1160330
Author:     Konstantin Belousov <kib@FreeBSD.org>
AuthorDate: 2026-08-04 15:52:53 +0000
Commit:     Konstantin Belousov <kib@FreeBSD.org>
CommitDate: 2026-08-16 02:41:18 +0000

    PF_KEY socket: limit the length of copied socket address

    PR:     297264

    (cherry picked from commit cba481a7bff2fcf31420ee8b2714660e2666452b)

 sys/netipsec/key.c | 128 +++++++++++++++++++++++++++++------------------------
 1 file changed, 69 insertions(+), 59 deletions(-)
Comment 7 commit-hook freebsd_committer freebsd_triage 2026-08-16 16:41:00 UTC
A commit in branch stable/14 references this bug:

URL: https://cgit.FreeBSD.org/src/commit/?id=022f935a1fbc75d39a055eee0a327cb2062a4596

commit 022f935a1fbc75d39a055eee0a327cb2062a4596
Author:     Konstantin Belousov <kib@FreeBSD.org>
AuthorDate: 2026-08-04 15:52:53 +0000
Commit:     Konstantin Belousov <kib@FreeBSD.org>
CommitDate: 2026-08-16 16:37:15 +0000

    PF_KEY socket: limit the length of copied socket address

    PR:     297264

    (cherry picked from commit cba481a7bff2fcf31420ee8b2714660e2666452b)

 sys/netipsec/key.c | 128 +++++++++++++++++++++++++++++------------------------
 1 file changed, 69 insertions(+), 59 deletions(-)
Comment 8 commit-hook freebsd_committer freebsd_triage 2026-08-18 01:28:21 UTC
A commit in branch releng/14.5 references this bug:

URL: https://cgit.FreeBSD.org/src/commit/?id=feecef8df3d8bddf5842f937e93d19e918674a65

commit feecef8df3d8bddf5842f937e93d19e918674a65
Author:     Konstantin Belousov <kib@FreeBSD.org>
AuthorDate: 2026-08-04 15:52:53 +0000
Commit:     Colin Percival <cperciva@FreeBSD.org>
CommitDate: 2026-08-18 01:27:38 +0000

    PF_KEY socket: limit the length of copied socket address

    Approved by:    re (cperciva)
    PR:     297264

    (cherry picked from commit cba481a7bff2fcf31420ee8b2714660e2666452b)
    (cherry picked from commit 022f935a1fbc75d39a055eee0a327cb2062a4596)

 sys/netipsec/key.c | 128 +++++++++++++++++++++++++++++------------------------
 1 file changed, 69 insertions(+), 59 deletions(-)