https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=255871
Bug ID: 255871
Summary: [PATCH] net: Fix a use after free in
update_rtm_from_rc
Product: Base System
Version: CURRENT
Hardware: Any
OS: Any
Status: New
Severity: Affects Many People
Priority: ---
Component: kern
Assignee: [email protected]
Reporter: [email protected]
Created attachment 224935
--> https://bugs.freebsd.org/bugzilla/attachment.cgi?id=224935&action=edit
assigning the new allocated *prtm to rtm
Bug File: sys/net/rtsock.c
In function update_rtm_from_rc, *prtm is assigned to rtm at line 946 and the
*prtm is freed by callee update_rtm_from_info() via free(orig_rtm, M_TEMP).
And then *prim was assigned with a new allocated rtm in this callee.
But now, the rtm in the caller still points to a freed memory object. The freed
memory object is used later by rtm->rtm_flags, rtm->rtm_rmx and
rtm->rtm_rmx.rmx_weight...
The root of this uaf bug is reassignment of *prim in callee does not change the
value of outside rtm. My patch fixs this error by assigning the new allocated
*prtm to rtm.
--
You are receiving this mail because:
You are the assignee for the bug.
_______________________________________________
[email protected] mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-bugs
To unsubscribe, send any mail to "[email protected]"
