diff options
| author | glebius <glebius@FreeBSD.org> | 2016-01-14 10:22:45 +0000 |
|---|---|---|
| committer | glebius <glebius@FreeBSD.org> | 2016-01-14 10:22:45 +0000 |
| commit | b4a3f7e7692d1fe6a5170df46b2f27c8eda25cd2 (patch) | |
| tree | b5120ec71e3c8e5a636f34e4f61d2d015f0b82a6 /sys/netinet | |
| parent | 796cbcc7388ed25b7353bd9266556844d1f346b7 (diff) | |
| download | FreeBSD-src-b4a3f7e7692d1fe6a5170df46b2f27c8eda25cd2.zip FreeBSD-src-b4a3f7e7692d1fe6a5170df46b2f27c8eda25cd2.tar.gz | |
There is a bug in tcp_output()'s implementation of the TCP_SIGNATURE
(RFC 2385/TCP-MD5) kernel option.
If a tcpcb has TF_NOOPT flag, then tcp_addoptions() is not called,
and to.to_signature is an uninitialized stack variable. The value
is later used as write offset, which leads to writing to random
address.
Submitted by: rstone, jtl
Security: SA-16:05.tcp
Diffstat (limited to 'sys/netinet')
| -rw-r--r-- | sys/netinet/tcp_output.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/sys/netinet/tcp_output.c b/sys/netinet/tcp_output.c index 3c32d77..4a4e7eb5 100644 --- a/sys/netinet/tcp_output.c +++ b/sys/netinet/tcp_output.c @@ -752,8 +752,8 @@ send: * segments. Options for SYN-ACK segments are handled in TCP * syncache. */ + to.to_flags = 0; if ((tp->t_flags & TF_NOOPT) == 0) { - to.to_flags = 0; /* Maximum segment size. */ if (flags & TH_SYN) { tp->snd_nxt = tp->iss; @@ -1233,7 +1233,7 @@ send: tp->snd_up = tp->snd_una; /* drag it along */ #ifdef TCP_SIGNATURE - if (tp->t_flags & TF_SIGNATURE) { + if (to.to_flags & TOF_SIGNATURE) { int sigoff = to.to_signature - opt; tcp_signature_compute(m, 0, len, optlen, (u_char *)(th + 1) + sigoff, IPSEC_DIR_OUTBOUND); @@ -1713,6 +1713,7 @@ tcp_addoptions(struct tcpopt *to, u_char *optp) bcopy((u_char *)&to->to_tsecr, optp, sizeof(to->to_tsecr)); optp += sizeof(to->to_tsecr); break; +#ifdef TCP_SIGNATURE case TOF_SIGNATURE: { int siglen = TCPOLEN_SIGNATURE - 2; @@ -1731,6 +1732,7 @@ tcp_addoptions(struct tcpopt *to, u_char *optp) *optp++ = 0; break; } +#endif case TOF_SACK: { int sackblks = 0; |
