[Bug 294989] pf: NULL pointer dereference in pf_sctp_multihome_detach_addr() via crafted pfsync state injection - Remote kernel panic

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=294989

--- Comment #3 from [email protected] ---
A commit in branch main references this bug:

URL:
https://cgit.FreeBSD.org/src/commit/?id=bf6d00afdb6171ba04a1c5a7fde904cde87d212d

commit bf6d00afdb6171ba04a1c5a7fde904cde87d212d
Author:     Kristof Provost <[email protected]>
AuthorDate: 2026-05-04 16:08:35 +0000
Commit:     Kristof Provost <[email protected]>
CommitDate: 2026-05-05 07:45:29 +0000

    pfsync: reject invalid SCTP states

    SCTP states should always have a src scrub object associated with them.
    Crafted pfsync packets might not have this, leading to us derferencing a
    NULL pointer on cleanup.

    Validate the pfsync state insertion packet to make sure this is correct.

    PR:             294989
    MFC after:      1 week
    Sponsored by:   Rubicon Communications, LLC ("Netgate")

 sys/netpfil/pf/if_pfsync.c | 7 +++++++
 1 file changed, 7 insertions(+)

-- 
You are receiving this mail because:
You are the assignee for the bug.