Three use-after-free bugs in the lwIP wget and dns command glue. Patch 1 fixes httpc_recv_cb(), which calls altcp_abort() on a store_block() failure but returns ERR_BUF instead of ERR_ABRT, so tcp_input() keeps using the freed pcb.
Patch 2 fixes wget, which keeps its transfer context on the stack and hands its address to the httpc callbacks. Ctrl-C while the host name is still resolving leaves the connection up, and a later callback runs against the freed stack frame, writing attacker-controlled data through store_block(). The context, together with the httpc connection settings that lwIP keeps a pointer to, moves to the heap with an ownership handoff to the lwIP callback. Patch 3 fixes the same stack-lifetime bug in the dns command, for its dns_gethostbyname() callback argument. A reproducer is available on request. Signed-off-by: Shahriyar Jalayeri <[email protected]> --- Changes in v2: - Patch 2: also move the httpc connection settings (and the TLS allocator they reference) into the heap context. lwIP keeps a pointer to them in httpc_state_t.conn_settings and dereferences it from the result and headers-done callbacks, so an abandoned request read its callback pointers from the freed stack too. (Jerome Forissier) --- Shahriyar Jalayeri (3): net: lwip: wget: return ERR_ABRT after aborting the connection net: lwip: wget: free the transfer context after an aborted request net: lwip: dns: free the callback context after an aborted lookup net/lwip/dns.c | 38 +++++++++++++++++---- net/lwip/wget.c | 101 ++++++++++++++++++++++++++++++++++++++++---------------- 2 files changed, 103 insertions(+), 36 deletions(-) --- base-commit: baa64b2f892890f00a377eac4a3e685472bb56b5 change-id: 20260811-lwip-httpc-uaf-31bf85307bce Best regards, -- Shahriyar Jalayeri <[email protected]>
