[Bug 283818] too-large rtmsg.rtm_family for RTM_GETADDR can cause wild pointer ref

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=283818

            Bug ID: 283818
           Summary: too-large rtmsg.rtm_family for RTM_GETADDR can cause
                    wild pointer ref
           Product: Base System
           Version: CURRENT
          Hardware: Any
                OS: Any
            Status: New
          Severity: Affects Some People
          Priority: ---
         Component: kern
          Assignee: bugs@FreeBSD.org
          Reporter: rtm@lcs.mit.edu
 Attachment #256375 text/plain
         mime type:

Created attachment 256375
  --> https://bugs.freebsd.org/bugzilla/attachment.cgi?id=256375&action=edit
RTM_GETROUTE with illegal rtm_family

The attached program supplies an illegally large rtm_family to netlink
RTM_GETROUTE, which causes rt_tables_get_rnh_ptr() to fetch a pointer
from beyond the end of V_rt_tables, which can lead to a crash in
rib_walk_ext_internal(). With INVARIANTS, this fails:


        KASSERT(family < (AF_MAX + 1),
            ("%s: fam out of bounds (%d < %d)", __func__, family, AF_MAX + 1));

# uname -a
FreeBSD  15.0-CURRENT FreeBSD 15.0-CURRENT #339
main-n250995-3750873316a1-dirty: Fri Jan  3 08:33:55 EST 2025    
rtm@xxx:/usr/obj/usr/rtm/symbsd/src/riscv.riscv64/sys/RTM riscv
# cc netlink6c.c
# ./a.out
panic: Fatal page fault at 0xffffffc0002f6e64: 0x424242424242432a
cpuid = 0
time = 1735908209
KDB: stack backtrace:
db_trace_self() at db_trace_self
db_trace_self_wrapper() at db_trace_self_wrapper+0x36
kdb_backtrace() at kdb_backtrace+0x2c
vpanic() at vpanic+0x16e
panic() at panic+0x26
page_fault_handler() at page_fault_handler+0x214
do_trap_supervisor() at do_trap_supervisor+0x6c
cpu_exception_handler_supervisor() at cpu_exception_handler_supervisor+0x74
--- exception 13, tval = 0x424242424242432a
_rm_rlock_debug() at _rm_rlock_debug+0x24
rib_walk() at rib_walk+0x7e
dump_rtable_one() at dump_rtable_one+0x68
rtnl_handle_getroute() at rtnl_handle_getroute+0x12c
rtnl_handle_message() at rtnl_handle_message+0x12a
nl_taskqueue_handler() at nl_taskqueue_handler+0x49a
taskqueue_run_locked() at taskqueue_run_locked+0x158
taskqueue_thread_loop() at taskqueue_thread_loop+0xd4
fork_exit() at fork_exit+0x68
fork_trampoline() at fork_trampoline+0xa
KDB: enter: panic

-- 
You are receiving this mail because:
You are the assignee for the bug.