misc/165373: Obvious use-after-free in ipfw_nat()

Arnaud Lacombe lacombar at gmail.com
Tue Feb 21 20:30:15 UTC 2012

>Number:         165373
>Category:       misc
>Synopsis:       Obvious use-after-free in ipfw_nat()
>Confidential:   no
>Severity:       non-critical
>Priority:       medium
>Responsible:    freebsd-bugs
>State:          open
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Tue Feb 21 20:30:11 UTC 2012
>Originator:     Arnaud Lacombe
>Release:        10-current
ipfw_nat() reads the following:

        mcl = m_megapullup(m, m->m_pkthdr.len);
        if (mcl == NULL) {
                args->m = NULL;
                return (IP_FW_DENY);
        ip = mtod(mcl, struct ip *);
        if (retval == PKT_ALIAS_RESPOND)
                m->m_flags |= M_SKIP_FIREWALL

It is quite obvious that `m' is no longer valid in the second conditional.

I reported this months ago on freebsd-net@ and did provide a patch to fix it, but no developers seems to actually care about such a bug.
read the code.


More information about the freebsd-bugs mailing list