svn commit: r344691 - head/sys/netpfil/pf

[Kristof Provost]

Author: kp
Date: Fri Mar  1 07:37:45 2019
New Revision: 344691
URL: https://svnweb.freebsd.org/changeset/base/344691

Log:
  pf: IPv6 fragments with malformed extension headers could be erroneously passed by pf or cause a panic
  
  We mistakenly used the extoff value from the last packet to patch the
  next_header field. If a malicious host sends a chain of fragmented packets
  where the first packet and the final packet have different lengths or number of
  extension headers we'd patch the next_header at the wrong offset.
  This can potentially lead to panics or rule bypasses.
  
  Security:       CVE-2019-5597
  Obtained from:  OpenBSD
  Reported by:    Corentin Bayet, Nicolas Collignon, Luca Moro at Synacktiv

Modified:
  head/sys/netpfil/pf/pf_norm.c

Modified: head/sys/netpfil/pf/pf_norm.c
==============================================================================
--- head/sys/netpfil/pf/pf_norm.c	Fri Mar  1 05:54:13 2019	(r344690)
+++ head/sys/netpfil/pf/pf_norm.c	Fri Mar  1 07:37:45 2019	(r344691)
@@ -836,11 +836,11 @@ pf_reassemble6(struct mbuf **m0, struct ip6_hdr *ip6, 
 	}
 
 	/* We have all the data. */
+	frent = TAILQ_FIRST(&frag->fr_queue);
+	KASSERT(frent != NULL, ("frent != NULL"));
 	extoff = frent->fe_extoff;
 	maxlen = frag->fr_maxlen;
 	frag_id = frag->fr_id;
-	frent = TAILQ_FIRST(&frag->fr_queue);
-	KASSERT(frent != NULL, ("frent != NULL"));
 	total = TAILQ_LAST(&frag->fr_queue, pf_fragq)->fe_off +
 		TAILQ_LAST(&frag->fr_queue, pf_fragq)->fe_len;
 	hdrlen = frent->fe_hdrlen - sizeof(struct ip6_frag);