[Midnightbsd-cvs] [MidnightBSD/src] 205f43: udp6: apply jail loopback rewriting to unconnected...

[Lucas Holt]

  Branch: refs/heads/stable/4.0
  Home:   https://github.com/MidnightBSD/src
  Commit: 205f435510fb67697916548dc61799bf2c393a26
      https://github.com/MidnightBSD/src/commit/205f435510fb67697916548dc61799bf2c393a26
  Author: Lucas Holt <luke at foolishgames.com>
  Date:   2026-10-02 (Fri, 02 Oct 2026)

  Changed paths:
    M sys/netinet6/udp6_usrreq.c

  Log Message:
  -----------
  udp6: apply jail loopback rewriting to unconnected sendto(2)

When a process in a classic (non-VNET) jail sends to the loopback
address, the kernel is supposed to rewrite the destination to the
jail's primary IP.  udp6_connect() and the IPv4 udp_send() do this via
prison_remote_ip6()/prison_remote_ip4(), but the IPv6 UDP send path for
unconnected sockets did not, so a jailed process could send UDP
datagrams to services listening on the host's IPv6 loopback address.

Apply prison_remote_ip6() to the destination in udp6_send() before
selecting the source address.

Security:       CVE-2026-101303
Security:       FreeBSD-SA-26:69.udp
Obtained from:  FreeBSD 809221661a81
AI-Assisted-by: Claude Fable 5.1

Co-Authored-By: Claude Fable 5.1 <noreply at anthropic.com>
Signed-off-by: Lucas Holt <luke at foolishgames.com>
(cherry picked from commit e8ea003e92ad8b56546d8b979ebc3f62b347e902)


  Commit: f93d07a9b9917b67a3ecc9255be57c2e425b721a
      https://github.com/MidnightBSD/src/commit/f93d07a9b9917b67a3ecc9255be57c2e425b721a
  Author: Lucas Holt <luke at foolishgames.com>
  Date:   2026-10-02 (Fri, 02 Oct 2026)

  Changed paths:
    M UPDATING

  Log Message:
  -----------
  UPDATING: udp6 jail loopback fix (CVE-2026-101303)

AI-Assisted-by: Claude Fable 5.1

Co-Authored-By: Claude Fable 5.1 <noreply at anthropic.com>
Signed-off-by: Lucas Holt <luke at foolishgames.com>
(cherry picked from commit 877558fd8d945d346abc737ca6f6f5fe3fcda6a7)


Compare: https://github.com/MidnightBSD/src/compare/05295d831259...f93d07a9b991

To unsubscribe from these emails, change your notification settings at https://github.com/MidnightBSD/src/settings/notifications