buglwIP - A Lightweight TCP/IP stack - Bugs: bug #41041, Potential use-after-free in IPv6...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #41041: Potential use-after-free in IPv6 reassembly

Submitter:  Valery Ushakov <uwe>
Submitted:  Tue 31 Dec 2013 02:00:17 AM UTC
   
 
Category:  IPv6 Severity:  3 - Normal
Item Group:  Faulty Behaviour Status:  Fixed
Privacy:  Public Assigned to:  goldsimon
Open/Closed:  Closed Planned Release:  None
lwIP version:  git head

Mon 19 May 2014 08:04:12 PM UTC, comment #5: 

Right. Thanks for reporting. I haven't seen this, though, and it slipped through since the bug was already closed :-(

Simon Goldschmidt <goldsimon>
Group administrator
Mon 17 Feb 2014 12:48:44 AM UTC, comment #4: 

Both IPv6 and IPv4 fixes have a fatal typo in the third expression of the for loop:

+verbartim+
for (ipr_prev = reassdatagrams; ipr_prev != NULL; ipr = ipr->next) {
-verbartim-

where ipr is assigned to instead of ipr_prev.

Valery Ushakov <uwe>
Fri 10 Jan 2014 08:48:05 PM UTC, comment #3: 

Fixed, thanks for reporting.

Simon Goldschmidt <goldsimon>
Group administrator
Fri 10 Jan 2014 08:45:09 PM UTC, comment #2: 

Since IPv6 reassembly was copied from IPv4 reassembly, this partly applies to ip_reass(), too.

Simon Goldschmidt <goldsimon>
Group administrator
Tue 31 Dec 2013 02:19:29 AM UTC, comment #1: 

Another use-after-free in ip6_reass() is the code to "Move pbuf back
to IPv6 header" which refers ipr after it was freed with memp_free().

Valery Ushakov <uwe>
Tue 31 Dec 2013 02:00:17 AM UTC, original submission:  

From source code inspection, haven't tried to reproduce it since that
would require sending specially crafted traffic.

ip6_reass() saves ipr_prev very early.

Later it may call ip6_reass_remove_oldest_datagram() to free up
resources.  It may so happen that the oldest datagram is the one we
saved in ipr_prev.

If a fragment hits resource limit and causes the oldest datagram to be
dropped and the datagram dropped is the one preceding current ipr in
the list and if the fragment is also the final fragment completing its
datagram, dangling ipr_prev will be accessed at the end of ip6_reass()
when it drops current ipr from the list.

Valery Ushakov <uwe>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by goldsimon (Posted a comment)
  • -email is unavailable- added by uwe (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 3 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2014-01-10 goldsimon StatusNone Fixed
        Assigned toNone goldsimon
        Open/ClosedOpen Closed

    Back to the top

    Powered by Savane 3.13-758e.
    Corresponding source code