The branch stable/14 has been updated by kp: URL: https://cgit.FreeBSD.org/src/commit/?id=8d583858e499dcc23a1c7b6b9c80e2e84f245d04
commit 8d583858e499dcc23a1c7b6b9c80e2e84f245d04 Author: Kristof Provost <[email protected]> AuthorDate: 2026-05-04 16:08:35 +0000 Commit: Kristof Provost <[email protected]> CommitDate: 2026-05-12 07:54:38 +0000 pfsync: reject invalid SCTP states SCTP states should always have a src scrub object associated with them. Crafted pfsync packets might not have this, leading to us derferencing a NULL pointer on cleanup. Validate the pfsync state insertion packet to make sure this is correct. PR: 294989 MFC after: 1 week Sponsored by: Rubicon Communications, LLC ("Netgate") (cherry picked from commit bf6d00afdb6171ba04a1c5a7fde904cde87d212d) --- sys/netpfil/pf/if_pfsync.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/sys/netpfil/pf/if_pfsync.c b/sys/netpfil/pf/if_pfsync.c index 6b828989c54d..10883e233b03 100644 --- a/sys/netpfil/pf/if_pfsync.c +++ b/sys/netpfil/pf/if_pfsync.c @@ -706,6 +706,13 @@ pfsync_state_import(union pfsync_state_union *sp, int flags, int msg_version) (st->act.rtableid >= 0 && st->act.rtableid < rt_numfibs))) goto cleanup; + if (sks->proto == IPPROTO_SCTP && st->src.scrub == NULL) { + if (V_pf_status.debug >= PF_DEBUG_MISC) + printf("%s: invalid SCTP state from creator id: %08x\n", __func__, + ntohl(sp->pfs_1301.creatorid)); + goto cleanup; + } + st->id = sp->pfs_1301.id; st->creatorid = sp->pfs_1301.creatorid; pf_state_peer_ntoh(&sp->pfs_1301.src, &st->src);
