buglwIP - A Lightweight TCP/IP stack - Bugs: bug #41041, Potential use-after-free in IPv6...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #41041: Potential use-after-free in IPv6 reassembly

Submitted by:  Valery Ushakov <uwe>
Submitted on:  Tue 31 Dec 2013 02:00:17 AM UTC  
 
Category: IPv6Severity: 3 - Normal
Item Group: Faulty BehaviourStatus: Fixed
Privacy: PublicAssigned to: Simon Goldschmidt <goldsimon>
Open/Closed: ClosedPlanned Release: None
lwIP version: git head

Mon 19 May 2014 08:04:12 PM UTC, comment #5:

Right. Thanks for reporting. I haven't seen this, though, and it slipped through since the bug was already closed :-(

Simon Goldschmidt <goldsimon>
Project AdministratorIn charge of this item.
Mon 17 Feb 2014 12:48:44 AM UTC, comment #4:

Both IPv6 and IPv4 fixes have a fatal typo in the third expression of the for loop:

+verbartim+
for (ipr_prev = reassdatagrams; ipr_prev != NULL; ipr = ipr->next) {
-verbartim-

where ipr is assigned to instead of ipr_prev.

Valery Ushakov <uwe>
Fri 10 Jan 2014 08:48:05 PM UTC, comment #3:

Fixed, thanks for reporting.

Simon Goldschmidt <goldsimon>
Project AdministratorIn charge of this item.
Fri 10 Jan 2014 08:45:09 PM UTC, comment #2:

Since IPv6 reassembly was copied from IPv4 reassembly, this partly applies to ip_reass(), too.

Simon Goldschmidt <goldsimon>
Project AdministratorIn charge of this item.
Tue 31 Dec 2013 02:19:29 AM UTC, comment #1:

Another use-after-free in ip6_reass() is the code to "Move pbuf back
to IPv6 header" which refers ipr after it was freed with memp_free().

Valery Ushakov <uwe>
Tue 31 Dec 2013 02:00:17 AM UTC, original submission:

From source code inspection, haven't tried to reproduce it since that
would require sending specially crafted traffic.

ip6_reass() saves ipr_prev very early.

Later it may call ip6_reass_remove_oldest_datagram() to free up
resources. It may so happen that the oldest datagram is the one we
saved in ipr_prev.

If a fragment hits resource limit and causes the oldest datagram to be
dropped and the datagram dropped is the one preceding current ipr in
the list and if the fragment is also the final fragment completing its
datagram, dangling ipr_prev will be accessed at the end of ip6_reass()
when it drops current ipr from the list.

Valery Ushakov <uwe>

 

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by goldsimon (Posted a comment)
  • -unavailable- added by uwe (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 3 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Fri 10 Jan 2014 08:48:05 PM UTCgoldsimonStatusNone=>Fixed
      Assigned toNone=>goldsimon
      Open/ClosedOpen=>Closed

    Back to the top


    Powered by Savane 3.1-cleanup1