buglwIP - A Lightweight TCP/IP stack - Bugs: bug #59603, Use-after-free if...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #59603: Use-after-free if tcp_process_refused_data() returns ERR_ABRT

Submitter:  Tom Vajzovic <tcv>
Submitted:  Wed 02 Dec 2020 08:37:24 PM UTC
   
 
Category:  TCP Severity:  3 - Normal
Item Group:  Crash Error Status:  None
Privacy:  Public Assigned to:  None
Open/Closed:  Open Planned Release:  None
lwIP version:  2.1.1

Tue 23 Aug 2022 08:10:50 AM UTC, comment #1: 

The tcp_process_refused_data function only returns err without actually releasing the PCB, so the tcp_input function can also access the PCB

wuchangsheng <wuchangsheng>
Wed 02 Dec 2020 08:37:24 PM UTC, original submission:  

Hi,

I think I've found a use-after-free in tcp_input().

If tcp_process_refused_data() returns ERR_ABRT, then tcp_input() continues to use the pcb (accessing pcb->refused_data, pcb->rcv_ann_wnd and calling tcp_send_empty_ack()).

I think it needs to goto aborted directly.

I'm not sure if there might also be a memory leak: does tcv_input() need to call tcp_abort() itself if the receive callback didn't return ERR_ABRT but ((pcb->refused_data != NULL) && (tcplen > 0)) is true?  If not then maybe it shouln't goto aborted in that case.

Thanks,
Tom

Tom Vajzovic <tcv>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by wuchangsheng (Posted a comment)
  • -email is unavailable- added by tcv (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    No changes have been made to this item

    Back to the top

    Powered by Savane 3.13-4448.
    Corresponding source code