Sponsored by: NetApp, Inc. MFC after: 1 week Reviewed By: tuexen, #transport, markj Differential Revision: https://reviews.freebsd.org/D58360 (cherry picked from commit f22b08443f6ae3620dd14ade4e2376b8531fd6f3)
According to RFC 1918, the following IP prefixes are reserved for
private internets:
10.0.0.0/8
172.16.0.0/12
192.168.0.0/16
This PR fixes the prefix lengths in references to private networks
("RFC 1918 networks", "the standard private IP address ranges").
The changes are limited to man pages.
Signed-off-by: Yusuke Ichiki <public@yusuke.pub>
Pull Request: https://github.com/freebsd/freebsd-src/pull/2328
(cherry picked from commit 1403ca10189c47ad1de3915eeb030deddc114685)
(cherry picked from commit c68eed82a3dcadf0c826e9e150f59769f4c44f24)
No functional change intended. MFC after: 1 week (cherry picked from commit 3b69c7201fd06b368090f2ee3840d384a949cba8)
libalias maintains a global list of all libalias handles. The list was updated without any locking, but nothing prevents updates from running concurrently. MFC after: 1 week (cherry picked from commit 2ff705f32a2033201a8f83f1ade5ddbc0460387d)
Malicious userspace might switch TCP stacks twice while the inpcb lock is dropped. If it does so, the validation of tp->t_fb might succeed, but the saved pointer to the stack PCB might be invalid. Reload it to avoid this problem, as BBR already does. Approved by: so Security: FreeBSD-SA-26:43.tcp Security: CVE-2026-49422 Reported by: Maik Münch Reviewed by: tuexen Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D57791
In alias_rtsp_out(), we construct a new packet in a fixed-length buffer before copying it back into the original buffer. We never checked if the data we were writing to this temporary buffer fit in it, nor if the result fit in the original buffer. * Use a dynamically sized allocated buffer instead of a fixed-length stack buffer. * Check for overflow before appending to our temporary buffer. * Check for overflow before copying the data back to the packet buffer. * While here, use size_t for sizes and bool for booleans. Approved by: so Security: FreeBSD-SA-26:41.libalias Security: CVE-2026-49420 MFC after: 1 week Reviewed by: markj Differential Revision: https://reviews.freebsd.org/D57753
We drop the inpcb lock in order to copy in the source list, but this leaves a window where the multicast filter structure might be freed. This can be exploited to obtain root privileges. In the v4 code this race is mitigated by holding the global multicast lock across the gap. Restructure the code to copy in filters before doing anything else, so that there's no need to drop the inpcb lock and reason about the correctness of doing so. Do the same in the v4 code for consistency. Approved by: so Security: FreeBSD-SA-26:29.ip6_multicast Security: CVE-2026-49412 Reported by: Andrew Griffiths <andrew@calif.io> Reported by: Maik Münch <maik@secfault-security.com> Reviewed by: glebius Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D57347
When igmp_v3_merge_state_changes() is iterating over state-change packets, there is a case where it'll free a queued packet but will fail to remove it from the queue. Fix that. Reported by: Yuxiang Yang, Yizhou Zhao, Xuewei Feng, Qi Li, and Ke Xu from Tsinghua University using GLM5.1 from Z.ai Reviewed by: pouria, glebius MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D56947 (cherry picked from commit beab4a237a45aea809e81802b9e1e9ff30f3d929)
No functional change intended. Reviewed by: pouria, rrs, Timo Völker Sponsored by: Netflix, Inc. Differential Revision: https://reviews.freebsd.org/D55415 (cherry picked from commit c984c7593e11aa95f21f79bb5425a9d5e9181945)