[Midnightbsd-cvs] [MidnightBSD/src] 8d5641: ktls: fix an off-by-one in tls13_find_record_type()

[Lucas Holt]

  Branch: refs/heads/stable/4.0
  Home:   https://github.com/MidnightBSD/src
  Commit: 8d564190bcf26d4311538f6a02dba55b1d59ce0a
      https://github.com/MidnightBSD/src/commit/8d564190bcf26d4311538f6a02dba55b1d59ce0a
  Author: Lucas Holt <luke at foolishgames.com>
  Date:   2026-10-01 (Thu, 01 Oct 2026)

  Changed paths:
    M sys/kern/uipc_ktls.c
    M tests/sys/kern/ktls_test.c

  Log Message:
  -----------
  ktls: fix an off-by-one in tls13_find_record_type()

TLS 1.3 stores the real record type as the last non-zero byte of the
decrypted payload, followed by optional zero padding.  The backwards
search for that byte recorded the offset one past it, which was then
compensated for when computing the trailer length.  If the entire
plaintext is zero-filled, the search returned the offset of the last
byte of the TLS header instead of failing, and the subsequent trailer
computation underflowed, leading to a NULL pointer dereference and a
kernel panic.

Record the offset of the type byte itself and compute the trailer
length from it directly, so that a record with no inner content type is
rejected with EBADMSG.  Add a regression test, adapted to the helpers
in our ktls_test.c.

A remote TLS 1.3 peer could send a crafted record to a socket using
software receive-side KTLS to panic the kernel.  Systems with
kern.ipc.tls.enable=0 are unaffected.

Security:       CVE-2026-101302
Security:       FreeBSD-SA-26:67.ktls
Obtained from:  FreeBSD fc1a02c93ba4
AI-Assisted-by: Claude Fable 5.1

Co-Authored-By: Claude Fable 5.1 <noreply at anthropic.com>
Signed-off-by: Lucas Holt <luke at foolishgames.com>
(cherry picked from commit 2e27a51bf8e94c5316d46ddade33ba202c8047f5)


  Commit: 05295d831259c5441f815e0ee611d62531f234d1
      https://github.com/MidnightBSD/src/commit/05295d831259c5441f815e0ee611d62531f234d1
  Author: Lucas Holt <luke at foolishgames.com>
  Date:   2026-10-01 (Thu, 01 Oct 2026)

  Changed paths:
    M UPDATING

  Log Message:
  -----------
  UPDATING: ktls receive-side DoS fix (CVE-2026-101302)

AI-Assisted-by: Claude Fable 5.1

Co-Authored-By: Claude Fable 5.1 <noreply at anthropic.com>
Signed-off-by: Lucas Holt <luke at foolishgames.com>
(cherry picked from commit fb7f39d2f2f7e926802f4ac69c2462a2383a5b2e)


Compare: https://github.com/MidnightBSD/src/compare/32d3e7565a5d...05295d831259

To unsubscribe from these emails, change your notification settings at https://github.com/MidnightBSD/src/settings/notifications