[Bug 255871] [PATCH] net: Fix a use after free in update_rtm_from_rc

[bugzilla-noreply at freebsd.org]

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=255871

            Bug ID: 255871
           Summary: [PATCH] net: Fix a use after free in
                    update_rtm_from_rc
           Product: Base System
           Version: CURRENT
          Hardware: Any
                OS: Any
            Status: New
          Severity: Affects Many People
          Priority: ---
         Component: kern
          Assignee: bugs at FreeBSD.org
          Reporter: lylgood at foxmail.com

Created attachment 224935
  --> https://bugs.freebsd.org/bugzilla/attachment.cgi?id=224935&action=edit
assigning the new allocated *prtm to rtm

Bug File: sys/net/rtsock.c

In function update_rtm_from_rc, *prtm is assigned to rtm at line 946 and the
*prtm is freed by callee update_rtm_from_info() via free(orig_rtm, M_TEMP).
And then *prim was assigned with a new allocated rtm in this callee. 

But now, the rtm in the caller still points to a freed memory object. The freed
memory object is used later by rtm->rtm_flags, rtm->rtm_rmx and
rtm->rtm_rmx.rmx_weight...

The root of this uaf bug is reassignment of *prim in callee does not change the
value of outside rtm. My patch fixs this error by assigning the new allocated
*prtm to rtm.

-- 
You are receiving this mail because:
You are the assignee for the bug.