diff options
| author | Mark Johnston <markj@FreeBSD.org> | 2026-09-21 14:05:01 +0000 |
|---|---|---|
| committer | Mark Johnston <markj@FreeBSD.org> | 2026-09-28 16:38:56 +0000 |
| commit | ba6c8cdf98264c0d6f38412e13693d8454e627a0 (patch) | |
| tree | 693d5a866b3aed0489e05ce4bcd44f925be7476f | |
| parent | 11a5387a12903d6866b1aa45a3f1f52acb29114a (diff) | |
udp: Let jail policy rewrite the dstaddr for v6 sendto()s
When performing an unconnected sendto() on a v6 UDP socket in a classic
jail, we were not applying the usual policy of replacing the loopback
addr with the jail's primary IP. Compare with, e.g., udp6_connect() or
the IPv4 udp_send(). Fix that.
Approved by: so
Security: FreeBSD-SA-26:69.udp
Security: CVE-2026-101303
Reported by: Yuxiang Yang, Yizhou Zhao, Ao Wang, Xuewei Feng, Qi Li,
and Ke Xu from Tsinghua University using GLM-5.1 from Z.ai
Reviewed by: bz, glebius
MFC after: 2 weeks
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D59772
(cherry picked from commit fecb9537a83b6746bc731a7cb3bcf6a33df79562)
(cherry picked from commit 809221661a8136a19661e4e379a44203e0ea2a03)
| -rw-r--r-- | sys/netinet6/udp6_usrreq.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/sys/netinet6/udp6_usrreq.c b/sys/netinet6/udp6_usrreq.c index 4622556adcfa..fcb218dcc677 100644 --- a/sys/netinet6/udp6_usrreq.c +++ b/sys/netinet6/udp6_usrreq.c @@ -823,6 +823,10 @@ udp6_send(struct socket *so, int flags_arg, struct mbuf *m, ("%s: sin6(%p)->sin6_addr is v4mapped which we " "should have handled.", __func__, sin6)); + error = prison_remote_ip6(td->td_ucred, &sin6->sin6_addr); + if (error != 0) + goto release; + /* This only requires read-locking. */ error = in6_selectsrc_socket(sin6, optp, inp, td->td_ucred, scope_ambiguous, &in6a, NULL); |