This account has published known LPEs and this one is recent: https://github.com/0xdeadbeefnetwork/pfkey-sadb-overflow Found via his X account: https://x.com/encrypted_past/status/2084448644460130572
Created attachment 273436 [details] patch suggested by Claude Sonnet 5.0
Mark, this is about IPSec code, not pf.
The pfkey_lpe sample does not work for me. But I think that the issue is real, https://reviews.freebsd.org/D58646
Blog entry: https://afflicted.sh/blog/posts/pfkey-sa-len-overflow.html
A commit in branch main references this bug: URL: https://cgit.FreeBSD.org/src/commit/?id=cba481a7bff2fcf31420ee8b2714660e2666452b commit cba481a7bff2fcf31420ee8b2714660e2666452b Author: Konstantin Belousov <kib@FreeBSD.org> AuthorDate: 2026-08-04 15:52:53 +0000 Commit: Konstantin Belousov <kib@FreeBSD.org> CommitDate: 2026-08-14 14:35:38 +0000 PF_KEY socket: limit the length of copied socket address for SADB_UPDATE op SADB_X_EXT_NEW_ADDRESS_SRC/DST extensions, by checking the sa_len matching the address family requirements before doing the copy. Also convert KEY_SETSECASIDX() and KEY_SETSECSPIDX() to functions and apply the sa_len clamping there. See https://github.com/0xdeadbeefnetwork/pfkey-sadb-overflow PR: 297264 Tested by: Wafa Hamzah <wafah@nvidia.com> (previous version) Reviewed by: markj Sponsored by: The FreeBSD Foundation MFC after: 1 week Differential revision: https://reviews.freebsd.org/D58646 sys/netipsec/key.c | 128 +++++++++++++++++++++++++++++------------------------ 1 file changed, 69 insertions(+), 59 deletions(-)
A commit in branch stable/15 references this bug: URL: https://cgit.FreeBSD.org/src/commit/?id=fffaf471280bf6f9e73603d84361a101e1160330 commit fffaf471280bf6f9e73603d84361a101e1160330 Author: Konstantin Belousov <kib@FreeBSD.org> AuthorDate: 2026-08-04 15:52:53 +0000 Commit: Konstantin Belousov <kib@FreeBSD.org> CommitDate: 2026-08-16 02:41:18 +0000 PF_KEY socket: limit the length of copied socket address PR: 297264 (cherry picked from commit cba481a7bff2fcf31420ee8b2714660e2666452b) sys/netipsec/key.c | 128 +++++++++++++++++++++++++++++------------------------ 1 file changed, 69 insertions(+), 59 deletions(-)
A commit in branch stable/14 references this bug: URL: https://cgit.FreeBSD.org/src/commit/?id=022f935a1fbc75d39a055eee0a327cb2062a4596 commit 022f935a1fbc75d39a055eee0a327cb2062a4596 Author: Konstantin Belousov <kib@FreeBSD.org> AuthorDate: 2026-08-04 15:52:53 +0000 Commit: Konstantin Belousov <kib@FreeBSD.org> CommitDate: 2026-08-16 16:37:15 +0000 PF_KEY socket: limit the length of copied socket address PR: 297264 (cherry picked from commit cba481a7bff2fcf31420ee8b2714660e2666452b) sys/netipsec/key.c | 128 +++++++++++++++++++++++++++++------------------------ 1 file changed, 69 insertions(+), 59 deletions(-)
A commit in branch releng/14.5 references this bug: URL: https://cgit.FreeBSD.org/src/commit/?id=feecef8df3d8bddf5842f937e93d19e918674a65 commit feecef8df3d8bddf5842f937e93d19e918674a65 Author: Konstantin Belousov <kib@FreeBSD.org> AuthorDate: 2026-08-04 15:52:53 +0000 Commit: Colin Percival <cperciva@FreeBSD.org> CommitDate: 2026-08-18 01:27:38 +0000 PF_KEY socket: limit the length of copied socket address Approved by: re (cperciva) PR: 297264 (cherry picked from commit cba481a7bff2fcf31420ee8b2714660e2666452b) (cherry picked from commit 022f935a1fbc75d39a055eee0a327cb2062a4596) sys/netipsec/key.c | 128 +++++++++++++++++++++++++++++------------------------ 1 file changed, 69 insertions(+), 59 deletions(-)