CVSROOT: /cvs Module name: src Changes by: [email protected] 2026/11/04 05:26:05
Modified files:
sys/net : pf.c
Log message:
pf(4) tcp scrub is prone to UAF when state times for matching packet
Yet another race between pf_test() and pf_purge_states() driven
by timeout thread. This time pf_test_state() may touch freed memory
in pf_normalize_tcp_stateful() when dereferencing ->scrub member.
Issue reported and patch submitted by Acts1631
OK OK renaud@, OK henning@
