CyberLeo.Net >> Repos - FreeBSD/FreeBSD.git/commit

author	Vincenzo Maffione <vmaffione@FreeBSD.org>
	Wed, 16 Mar 2022 06:58:50 +0000 (06:58 +0000)
committer	Ed Maste <emaste@FreeBSD.org>
	Wed, 6 Apr 2022 03:24:05 +0000 (23:24 -0400)
commit	7c55c52696d2aec39441802d687badc8b012432e
tree	d9e347d4d05c0359f094b2ff8f0375e19157dc93	tree \| snapshot
parent	9d354cf6e141a55ad1ef0cb85316f39013d594d2	commit \| diff

netmap: Fix TOCTOU vulnerability in nmreq_copyin

The total size of the user-provided nmreq was first computed and then
trusted during the copyin. This might lead to kernel memory corruption
and escape from jails/containers.

Reported by: Lucas Leong (@_wmliang_) of Trend Micro Zero Day Initiative
Security: CVE-2022-23084
MFC after: 3 days

(cherry picked from commit 393729916564ed13f966e09129a24e6931898d12)
(cherry picked from commit 9f600a260a738d87015b2e9722b7b4f228cbd47d)

Approved by: so, re (implicit)