Plug routing sysctl leaks.
Various structures exported by sysctl_rtsock() contain padding fields which were not being zeroed. Reported by: Thomas Barabosch, Fraunhofer FKIE Reviewed by: ae MFC after: 3 days Security: kernel memory disclosure Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D18333
This commit is contained in:
parent
7d69e4cde7
commit
d25f8522be
Notes:
svn2git
2020-12-20 02:59:44 +00:00
svn path=/head/; revision=340968
@ -271,6 +271,7 @@ struct if_msghdr {
|
|||||||
int ifm_addrs; /* like rtm_addrs */
|
int ifm_addrs; /* like rtm_addrs */
|
||||||
int ifm_flags; /* value of if_flags */
|
int ifm_flags; /* value of if_flags */
|
||||||
u_short ifm_index; /* index for associated ifp */
|
u_short ifm_index; /* index for associated ifp */
|
||||||
|
u_short _ifm_spare1;
|
||||||
struct if_data ifm_data;/* statistics and other data about if */
|
struct if_data ifm_data;/* statistics and other data about if */
|
||||||
};
|
};
|
||||||
|
|
||||||
@ -296,6 +297,7 @@ struct if_msghdrl {
|
|||||||
u_short _ifm_spare1; /* spare space to grow if_index, see if_var.h */
|
u_short _ifm_spare1; /* spare space to grow if_index, see if_var.h */
|
||||||
u_short ifm_len; /* length of if_msghdrl incl. if_data */
|
u_short ifm_len; /* length of if_msghdrl incl. if_data */
|
||||||
u_short ifm_data_off; /* offset of if_data from beginning */
|
u_short ifm_data_off; /* offset of if_data from beginning */
|
||||||
|
int _ifm_spare2;
|
||||||
struct if_data ifm_data;/* statistics and other data about if */
|
struct if_data ifm_data;/* statistics and other data about if */
|
||||||
};
|
};
|
||||||
|
|
||||||
@ -311,6 +313,7 @@ struct ifa_msghdr {
|
|||||||
int ifam_addrs; /* like rtm_addrs */
|
int ifam_addrs; /* like rtm_addrs */
|
||||||
int ifam_flags; /* value of ifa_flags */
|
int ifam_flags; /* value of ifa_flags */
|
||||||
u_short ifam_index; /* index for associated ifp */
|
u_short ifam_index; /* index for associated ifp */
|
||||||
|
u_short _ifam_spare1;
|
||||||
int ifam_metric; /* value of ifa_ifp->if_metric */
|
int ifam_metric; /* value of ifa_ifp->if_metric */
|
||||||
};
|
};
|
||||||
|
|
||||||
@ -352,6 +355,7 @@ struct ifma_msghdr {
|
|||||||
int ifmam_addrs; /* like rtm_addrs */
|
int ifmam_addrs; /* like rtm_addrs */
|
||||||
int ifmam_flags; /* value of ifa_flags */
|
int ifmam_flags; /* value of ifa_flags */
|
||||||
u_short ifmam_index; /* index for associated ifp */
|
u_short ifmam_index; /* index for associated ifp */
|
||||||
|
u_short _ifmam_spare1;
|
||||||
};
|
};
|
||||||
|
|
||||||
/*
|
/*
|
||||||
|
@ -251,6 +251,7 @@ struct rt_msghdr {
|
|||||||
u_char rtm_version; /* future binary compatibility */
|
u_char rtm_version; /* future binary compatibility */
|
||||||
u_char rtm_type; /* message type */
|
u_char rtm_type; /* message type */
|
||||||
u_short rtm_index; /* index for associated ifp */
|
u_short rtm_index; /* index for associated ifp */
|
||||||
|
u_short _rtm_spare1;
|
||||||
int rtm_flags; /* flags, incl. kern & message, e.g. DONE */
|
int rtm_flags; /* flags, incl. kern & message, e.g. DONE */
|
||||||
int rtm_addrs; /* bitmask identifying sockaddrs in msg */
|
int rtm_addrs; /* bitmask identifying sockaddrs in msg */
|
||||||
pid_t rtm_pid; /* identify sender */
|
pid_t rtm_pid; /* identify sender */
|
||||||
|
@ -83,6 +83,7 @@ struct if_msghdr32 {
|
|||||||
int32_t ifm_addrs;
|
int32_t ifm_addrs;
|
||||||
int32_t ifm_flags;
|
int32_t ifm_flags;
|
||||||
uint16_t ifm_index;
|
uint16_t ifm_index;
|
||||||
|
uint16_t _ifm_spare1;
|
||||||
struct if_data ifm_data;
|
struct if_data ifm_data;
|
||||||
};
|
};
|
||||||
|
|
||||||
@ -96,6 +97,7 @@ struct if_msghdrl32 {
|
|||||||
uint16_t _ifm_spare1;
|
uint16_t _ifm_spare1;
|
||||||
uint16_t ifm_len;
|
uint16_t ifm_len;
|
||||||
uint16_t ifm_data_off;
|
uint16_t ifm_data_off;
|
||||||
|
uint32_t _ifm_spare2;
|
||||||
struct if_data ifm_data;
|
struct if_data ifm_data;
|
||||||
};
|
};
|
||||||
|
|
||||||
@ -1219,8 +1221,11 @@ rtsock_msg_buffer(int type, struct rt_addrinfo *rtinfo, struct walkarg *w, int *
|
|||||||
dlen = ALIGN(len) - len;
|
dlen = ALIGN(len) - len;
|
||||||
if (buflen < dlen)
|
if (buflen < dlen)
|
||||||
cp = NULL;
|
cp = NULL;
|
||||||
else
|
else {
|
||||||
|
bzero(cp, dlen);
|
||||||
|
cp += dlen;
|
||||||
buflen -= dlen;
|
buflen -= dlen;
|
||||||
|
}
|
||||||
}
|
}
|
||||||
len = ALIGN(len);
|
len = ALIGN(len);
|
||||||
|
|
||||||
@ -1577,6 +1582,8 @@ sysctl_dumpentry(struct radix_node *rn, void *vw)
|
|||||||
if (w->w_req && w->w_tmem) {
|
if (w->w_req && w->w_tmem) {
|
||||||
struct rt_msghdr *rtm = (struct rt_msghdr *)w->w_tmem;
|
struct rt_msghdr *rtm = (struct rt_msghdr *)w->w_tmem;
|
||||||
|
|
||||||
|
bzero(&rtm->rtm_index,
|
||||||
|
sizeof(*rtm) - offsetof(struct rt_msghdr, rtm_index));
|
||||||
if (rt->rt_flags & RTF_GWFLAG_COMPAT)
|
if (rt->rt_flags & RTF_GWFLAG_COMPAT)
|
||||||
rtm->rtm_flags = RTF_GATEWAY |
|
rtm->rtm_flags = RTF_GATEWAY |
|
||||||
(rt->rt_flags & ~RTF_GWFLAG_COMPAT);
|
(rt->rt_flags & ~RTF_GWFLAG_COMPAT);
|
||||||
@ -1584,7 +1591,6 @@ sysctl_dumpentry(struct radix_node *rn, void *vw)
|
|||||||
rtm->rtm_flags = rt->rt_flags;
|
rtm->rtm_flags = rt->rt_flags;
|
||||||
rt_getmetrics(rt, &rtm->rtm_rmx);
|
rt_getmetrics(rt, &rtm->rtm_rmx);
|
||||||
rtm->rtm_index = rt->rt_ifp->if_index;
|
rtm->rtm_index = rt->rt_ifp->if_index;
|
||||||
rtm->rtm_errno = rtm->rtm_pid = rtm->rtm_seq = 0;
|
|
||||||
rtm->rtm_addrs = info.rti_addrs;
|
rtm->rtm_addrs = info.rti_addrs;
|
||||||
error = SYSCTL_OUT(w->w_req, (caddr_t)rtm, size);
|
error = SYSCTL_OUT(w->w_req, (caddr_t)rtm, size);
|
||||||
return (error);
|
return (error);
|
||||||
@ -1612,6 +1618,7 @@ sysctl_iflist_ifml(struct ifnet *ifp, const struct if_data *src_ifd,
|
|||||||
ifm32->_ifm_spare1 = 0;
|
ifm32->_ifm_spare1 = 0;
|
||||||
ifm32->ifm_len = sizeof(*ifm32);
|
ifm32->ifm_len = sizeof(*ifm32);
|
||||||
ifm32->ifm_data_off = offsetof(struct if_msghdrl32, ifm_data);
|
ifm32->ifm_data_off = offsetof(struct if_msghdrl32, ifm_data);
|
||||||
|
ifm32->_ifm_spare2 = 0;
|
||||||
ifd = &ifm32->ifm_data;
|
ifd = &ifm32->ifm_data;
|
||||||
} else
|
} else
|
||||||
#endif
|
#endif
|
||||||
@ -1622,6 +1629,7 @@ sysctl_iflist_ifml(struct ifnet *ifp, const struct if_data *src_ifd,
|
|||||||
ifm->_ifm_spare1 = 0;
|
ifm->_ifm_spare1 = 0;
|
||||||
ifm->ifm_len = sizeof(*ifm);
|
ifm->ifm_len = sizeof(*ifm);
|
||||||
ifm->ifm_data_off = offsetof(struct if_msghdrl, ifm_data);
|
ifm->ifm_data_off = offsetof(struct if_msghdrl, ifm_data);
|
||||||
|
ifm->_ifm_spare2 = 0;
|
||||||
ifd = &ifm->ifm_data;
|
ifd = &ifm->ifm_data;
|
||||||
}
|
}
|
||||||
|
|
||||||
@ -1647,6 +1655,7 @@ sysctl_iflist_ifm(struct ifnet *ifp, const struct if_data *src_ifd,
|
|||||||
ifm32->ifm_addrs = info->rti_addrs;
|
ifm32->ifm_addrs = info->rti_addrs;
|
||||||
ifm32->ifm_flags = ifp->if_flags | ifp->if_drv_flags;
|
ifm32->ifm_flags = ifp->if_flags | ifp->if_drv_flags;
|
||||||
ifm32->ifm_index = ifp->if_index;
|
ifm32->ifm_index = ifp->if_index;
|
||||||
|
ifm32->_ifm_spare1 = 0;
|
||||||
ifd = &ifm32->ifm_data;
|
ifd = &ifm32->ifm_data;
|
||||||
} else
|
} else
|
||||||
#endif
|
#endif
|
||||||
@ -1654,6 +1663,7 @@ sysctl_iflist_ifm(struct ifnet *ifp, const struct if_data *src_ifd,
|
|||||||
ifm->ifm_addrs = info->rti_addrs;
|
ifm->ifm_addrs = info->rti_addrs;
|
||||||
ifm->ifm_flags = ifp->if_flags | ifp->if_drv_flags;
|
ifm->ifm_flags = ifp->if_flags | ifp->if_drv_flags;
|
||||||
ifm->ifm_index = ifp->if_index;
|
ifm->ifm_index = ifp->if_index;
|
||||||
|
ifm->_ifm_spare1 = 0;
|
||||||
ifd = &ifm->ifm_data;
|
ifd = &ifm->ifm_data;
|
||||||
}
|
}
|
||||||
|
|
||||||
@ -1722,6 +1732,7 @@ sysctl_iflist_ifam(struct ifaddr *ifa, struct rt_addrinfo *info,
|
|||||||
ifam->ifam_addrs = info->rti_addrs;
|
ifam->ifam_addrs = info->rti_addrs;
|
||||||
ifam->ifam_flags = ifa->ifa_flags;
|
ifam->ifam_flags = ifa->ifa_flags;
|
||||||
ifam->ifam_index = ifa->ifa_ifp->if_index;
|
ifam->ifam_index = ifa->ifa_ifp->if_index;
|
||||||
|
ifam->_ifam_spare1 = 0;
|
||||||
ifam->ifam_metric = ifa->ifa_ifp->if_metric;
|
ifam->ifam_metric = ifa->ifa_ifp->if_metric;
|
||||||
|
|
||||||
return (SYSCTL_OUT(w->w_req, w->w_tmem, len));
|
return (SYSCTL_OUT(w->w_req, w->w_tmem, len));
|
||||||
@ -1833,6 +1844,7 @@ sysctl_ifmalist(int af, struct walkarg *w)
|
|||||||
ifmam->ifmam_index = ifma->ifma_ifp->if_index;
|
ifmam->ifmam_index = ifma->ifma_ifp->if_index;
|
||||||
ifmam->ifmam_flags = 0;
|
ifmam->ifmam_flags = 0;
|
||||||
ifmam->ifmam_addrs = info.rti_addrs;
|
ifmam->ifmam_addrs = info.rti_addrs;
|
||||||
|
ifmam->_ifmam_spare1 = 0;
|
||||||
error = SYSCTL_OUT(w->w_req, w->w_tmem, len);
|
error = SYSCTL_OUT(w->w_req, w->w_tmem, len);
|
||||||
if (error != 0)
|
if (error != 0)
|
||||||
break;
|
break;
|
||||||
|
Loading…
Reference in New Issue
Block a user