svn commit: r359138 - in releng: 11.3/sys/netinet 12.1/sys/netinet

[Gordon Tetlow]

Author: gordon
Date: Thu Mar 19 16:46:01 2020
New Revision: 359138
URL: https://svnweb.freebsd.org/changeset/base/359138

Log:
  Fix TCP IPv6 SYN cache kernel information disclosure.
  
  Approved by:	so
  Security:	FreeBSD-SA-20:04.tcp
  Security:	CVE-2020-7451

Modified:
  releng/11.3/sys/netinet/tcp_syncache.c
  releng/12.1/sys/netinet/tcp_syncache.c

Modified: releng/11.3/sys/netinet/tcp_syncache.c
==============================================================================
--- releng/11.3/sys/netinet/tcp_syncache.c	Thu Mar 19 16:43:37 2020	(r359137)
+++ releng/11.3/sys/netinet/tcp_syncache.c	Thu Mar 19 16:46:01 2020	(r359138)
@@ -1679,7 +1679,8 @@ syncache_respond(struct syncache *sc, struct syncache_
 		ip6->ip6_dst = sc->sc_inc.inc6_faddr;
 		ip6->ip6_plen = htons(tlen - hlen);
 		/* ip6_hlim is set after checksum */
-		ip6->ip6_flow &= ~IPV6_FLOWLABEL_MASK;
+		/* Zero out traffic class and flow label. */
+		ip6->ip6_flow &= ~IPV6_FLOWINFO_MASK;
 		ip6->ip6_flow |= sc->sc_flowlabel;
 
 		th = (struct tcphdr *)(ip6 + 1);

Modified: releng/12.1/sys/netinet/tcp_syncache.c
==============================================================================
--- releng/12.1/sys/netinet/tcp_syncache.c	Thu Mar 19 16:43:37 2020	(r359137)
+++ releng/12.1/sys/netinet/tcp_syncache.c	Thu Mar 19 16:46:01 2020	(r359138)
@@ -1728,7 +1728,8 @@ syncache_respond(struct syncache *sc, struct syncache_
 		ip6->ip6_dst = sc->sc_inc.inc6_faddr;
 		ip6->ip6_plen = htons(tlen - hlen);
 		/* ip6_hlim is set after checksum */
-		ip6->ip6_flow &= ~IPV6_FLOWLABEL_MASK;
+		/* Zero out traffic class and flow label. */
+		ip6->ip6_flow &= ~IPV6_FLOWINFO_MASK;
 		ip6->ip6_flow |= sc->sc_flowlabel;
 
 		th = (struct tcphdr *)(ip6 + 1);