git: if_ether: Reject invalid ARP packets to avoid kernel memory leaking

[Aaron LI]

commit 4bb22ffcf2e9fb44995fbfd9945194afc87fb182
Author: Aaron LI <aly at aaronly.me>
Date:   Sat Sep 12 09:51:56 2026 +0800

    if_ether: Reject invalid ARP packets to avoid kernel memory leaking
    
    The ARP ingress parser arpintr() validates ar_hrd and ar_pro but never
    validates ar_hln (hardware address length) or ar_pln (protocol address
    length). The ARP reply builder in_arpreply() then uses these
    attacker-controlled byte values as memcpy lengths when copying from
    kernel-internal buffers that hold only 6 bytes (IF_LLADDR) or 4 bytes
    (&taddr on stack). The over-read bytes fill the ARP reply mbuf, which is
    transmitted back to the attacker. A single crafted ARP request from any
    host on the same L2 segment leaks up to ~249 bytes of kernel heap and
    ~251 bytes of kernel stack.
    
    Fix the bug by rejecting ARP packets with invalid ar_hln or ar_pln.
    
    This patch is derived from FreeBSD:
    - https://github.com/freebsd/freebsd-src/commit/09d3f8953e47a33d298a13b77eed55f54ae5247b
    - https://github.com/freebsd/freebsd-src/commit/414676ba31117f4ddda936d0035398eb7dfdfa34
    - https://github.com/freebsd/freebsd-src/commit/deb6bda6e373d7d01f43d5cc2d724dcecbae2039
    
    Reporter: Nathan Sapwell
    Finding-ID: DF-0494
    Assisted-by: Zhipu GLM-5.2

Summary of changes:
 sys/netinet/if_ether.c | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)

http://gitweb.dragonflybsd.org/dragonfly.git/commitdiff/4bb22ffcf2e9fb44995fbfd9945194afc87fb182


-- 
DragonFly BSD source repository