upstream/opnsense-src
1
0
Fork 0
mirror of https://github.com/opnsense/src.git synced 2026-07-16 22:37:15 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions
opnsense-src/sys/netinet6
History
Mark Johnston 6a23a684b2 in6_mcast: Fix a race in in6p_set_source_filter() 
We drop the inpcb lock in order to copy in the source list, but this
leaves a window where the multicast filter structure might be freed.
This can be exploited to obtain root privileges.

In the v4 code this race is mitigated by holding the global multicast
lock across the gap.

Restructure the code to copy in filters before doing anything else, so
that there's no need to drop the inpcb lock and reason about the
correctness of doing so.  Do the same in the v4 code for consistency.

Approved by:	re (cperciva)
Approved by:	so
Security:	FreeBSD-SA-26:29.ip6_multicast
Security:	CVE-2026-49412
Reported by:	Andrew Griffiths <andrew@calif.io>
Reported by:	Maik Münch <maik@secfault-security.com>
Reviewed by:	glebius
Sponsored by:	The FreeBSD Foundation
Differential Revision:	https://reviews.freebsd.org/D57347
2026-06-10 08:45:21 +02:00
..
dest6.c sys: Remove $FreeBSD$: one-line .c pattern 2023-08-16 11:54:36 -06:00
frag6.c rss: add sysctl enable toggle 2025-07-09 10:05:48 +02:00
icmp6.c icmp6: clear csum_flags on mbuf reuse 2026-02-24 10:11:30 +01:00
icmp6.h sys: Remove $FreeBSD$: one-line .c comment pattern 2023-08-16 11:54:24 -06:00
in6.c in6: modify address prefix lifetimes when updating address lifetimes 2026-01-10 09:15:07 +01:00
in6.h in6: modify address prefix lifetimes when updating address lifetimes 2026-01-10 09:15:07 +01:00
in6_cksum.c ip6_cksum.c: generalize in6_cksum_partial() to allow L2 headers in passed mbuf 2025-03-20 05:13:36 +02:00
in6_fib.c sys: Remove $FreeBSD$: one-line .c pattern 2023-08-16 11:54:36 -06:00
in6_fib.h sys: Remove $FreeBSD$: two-line .h pattern 2023-08-16 11:54:11 -06:00
in6_fib_algo.c netinet6: Use proper prototype for SYSINIT functions 2026-02-18 13:10:37 +01:00
in6_gif.c sys: Remove $FreeBSD$: one-line .c pattern 2023-08-16 11:54:36 -06:00
in6_ifattach.c netinet6: Remove a set but not used global variable in6_maxmtu 2025-07-09 10:05:51 +02:00
in6_ifattach.h sys: Remove $FreeBSD$: one-line .h pattern 2023-08-16 11:54:18 -06:00
in6_jail.c sys: Remove $FreeBSD$: one-line .c pattern 2023-08-16 11:54:36 -06:00
in6_mcast.c in6_mcast: Fix a race in in6p_set_source_filter() 2026-06-10 08:45:21 +02:00
in6_pcb.c rss: add sysctl enable toggle 2025-07-09 10:05:48 +02:00
in6_pcb.h inpcb: Add FIB-aware inpcb lookup 2025-02-21 01:04:50 +00:00
in6_proto.c icmp6: move ICMPv6 related tunables to the files where they are used 2024-06-26 12:48:44 +08:00
in6_rmx.c sys: Remove $FreeBSD$: one-line .c pattern 2023-08-16 11:54:36 -06:00
in6_rss.c sys: Remove $FreeBSD$: two-line .c pattern 2023-08-16 11:54:30 -06:00
in6_rss.h sys: Remove $FreeBSD$: two-line .h pattern 2023-08-16 11:54:11 -06:00
in6_src.c carp6: revise the generation of ND6 NA 2026-01-20 09:48:47 +01:00
in6_var.h netinet6: Remove a set but not used global variable in6_maxmtu 2025-07-09 10:05:51 +02:00
ip6.h sys: Remove $FreeBSD$: one-line .c comment pattern 2023-08-16 11:54:24 -06:00
ip6_ecn.h sys: Remove $FreeBSD$: one-line .h pattern 2023-08-16 11:54:18 -06:00
ip6_fastfwd.c netinet(6): shared forwarding requires different pointers 2025-10-23 17:39:39 +02:00
ip6_forward.c netinet(6): shared forwarding requires different pointers 2025-10-23 17:39:39 +02:00
ip6_gre.c sys: Remove $FreeBSD$: one-line .c pattern 2023-08-16 11:54:36 -06:00
ip6_id.c sys: Remove $FreeBSD$: one-line .c pattern 2023-08-16 11:54:36 -06:00
ip6_input.c ip6: add SO_BINTIME support 2026-01-20 10:18:46 +01:00
ip6_mroute.c ip6_mroute: Fix the UPCALL_TIMING build 2026-02-18 13:12:12 +01:00
ip6_mroute.h sys: Remove $FreeBSD$: one-line .h pattern 2023-08-16 11:54:18 -06:00
ip6_output.c ipv6: account for jumbo payload option 2026-01-27 13:47:18 +01:00
ip6_var.h carp6: revise the generation of ND6 NA 2026-01-20 09:48:47 +01:00
ip_fw_nat64.h sys: Remove $FreeBSD$: two-line .h pattern 2023-08-16 11:54:11 -06:00
ip_fw_nptv6.h sys: Remove $FreeBSD$: two-line .h pattern 2023-08-16 11:54:11 -06:00
mld6.c sys: Use mbufq_empty instead of comparing mbufq_len against 0 2024-01-18 14:37:29 -08:00
mld6.h sys: Remove $FreeBSD$: two-line .h pattern 2023-08-16 11:54:11 -06:00
mld6_var.h sys: Remove $FreeBSD$: two-line .h pattern 2023-08-16 11:54:11 -06:00
nd6.c netinet6: Remove a set but not used global variable in6_maxmtu 2025-07-09 10:05:51 +02:00
nd6.h carp6: revise the generation of ND6 NA 2026-01-20 09:48:47 +01:00
nd6_nbr.c carp6: revise the generation of ND6 NA 2026-01-20 09:48:47 +01:00
nd6_rtr.c in6: modify address prefix lifetimes when updating address lifetimes 2026-01-10 09:15:07 +01:00
pim6.h sys: Remove $FreeBSD$: one-line .h pattern 2023-08-16 11:54:18 -06:00
pim6_var.h sys: Remove $FreeBSD$: one-line .h pattern 2023-08-16 11:54:18 -06:00
raw_ip6.c ip_mroute: Make privilege checking more consistent 2026-02-18 13:08:13 +01:00
raw_ip6.h sys: Remove $FreeBSD$: one-line .h pattern 2023-08-16 11:54:18 -06:00
route6.c sys: Remove $FreeBSD$: one-line .c pattern 2023-08-16 11:54:36 -06:00
scope6.c netinet6: Fix two typos in source code comments 2024-01-25 07:46:35 +01:00
scope6_var.h sys: Remove $FreeBSD$: one-line .h pattern 2023-08-16 11:54:18 -06:00
sctp6_usrreq.c sctp, tcp, udp: improve deferred computation of checksums 2025-10-23 08:10:56 +02:00
sctp6_var.h sctp: cleanup cdefs.h include 2023-08-18 15:25:34 +02:00
send.c sys: Remove $FreeBSD$: one-line .c pattern 2023-08-16 11:54:36 -06:00
send.h sys: Remove $FreeBSD$: two-line .h pattern 2023-08-16 11:54:11 -06:00
tcp6_var.h sys: Remove $FreeBSD$: one-line .h pattern 2023-08-16 11:54:18 -06:00
udp6_usrreq.c sctp, tcp, udp: improve deferred computation of checksums 2025-10-23 08:10:56 +02:00
udp6_var.h sys: Remove $FreeBSD$: one-line .h pattern 2023-08-16 11:54:18 -06:00