W dniu 05.11.2020 o 01:41, mike tancsa pisze:
Hi,
Is this an issue in HEAD only ? Or is it something that needs to be
MFC'd ?
---Mike
It has been MFCed to 12-STABLE with r367402[1].
What about 11-STABLE users? Should they be worried about missing MFC as
well or ignore the issue as non-exploitable on their systems?
[1]
https://lists.freebsd.org/pipermail/svn-src-all/2020-November/204977.html
--
Marek Zarychta
On 10/28/2020 4:27 PM, Alexander V. Chernikov wrote:
28.10.2020, 20:25, "Alexander V. Chernikov" <[email protected]>:
28.10.2020, 18:34, "Maxime Villard" <[email protected]>:
In icmp6_notify_error(), 'finaldst' points to data within an mbuf, but when
iterating over the next IPv6 options the kernel can free that mbuf, meaning
the dereferences of 'finaldst' hit a freed buffer.
[sorry for reposting, plaintext this time]
Fixed in r367114, thanks for reporting!
Note that this is triggerable without specific conditions, over just ICMPv6.
Maxime
_______________________________________________
[email protected] mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-net
To unsubscribe, send any mail to "[email protected]"
_______________________________________________
[email protected] mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-net
To unsubscribe, send any mail to "[email protected]"
_______________________________________________
[email protected] mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-net
To unsubscribe, send any mail to "[email protected]"
_______________________________________________
[email protected] mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-net
To unsubscribe, send any mail to "[email protected]"
