CyberLeo.Net >> Repos - FreeBSD/FreeBSD.git/commit

author	Vincenzo Maffione <vmaffione@FreeBSD.org>
	Tue, 5 Apr 2022 23:20:34 +0000 (23:20 +0000)
committer	Ed Maste <emaste@FreeBSD.org>
	Tue, 5 Apr 2022 23:20:34 +0000 (23:20 +0000)
commit	5e67ca45e9a37180783f93faf0801c5c86366b9f
tree	20024e63aaee47da1518da7ce4202c661a6d008f	tree \| snapshot
parent	0d1f1dc951c667f9d993acba42358d115997564e	commit \| diff

netmap: Fix TOCTOU vulnerability in nmreq_copyin

The total size of the user-provided nmreq was first computed and then
trusted during the copyin. This might lead to kernel memory corruption
and escape from jails/containers.

Reported by: Lucas Leong (@_wmliang_) of Trend Micro Zero Day Initiative
Security: CVE-2022-23084
MFC after: 3 days

(cherry picked from commit 393729916564ed13f966e09129a24e6931898d12)
(cherry picked from commit 6fa8af618475024262fc99b0f0e6c2aa0e1340fe)

Approved by: so
Security: FreeBSD-SA-22:04.netmap