kern/60491: arp creates state for invalid messages

"[email protected] via gnats" <[email protected]> Thu, 23 Jul 2026 21:00:01 +0000 (UTC)

Newsgroups	gmane.os.netbsd.bugs
Message-ID	<[email protected]>

>Number:         60491
>Category:       kern
>Synopsis:       arp creates state for invalid messages
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Thu Jul 23 21:00:00 +0000 2026
>Originator:     Taylor R Campbell
>Release:        
>Organization:
The NetBSD Addressolution, Invalid
>Environment:
>Description:

	The arp input path doesn't validate the op until after it has
	allocated memory and stored state for the message, causing the
	kernel to waste memory and report invalid arp entries to the
	system.

	Forwarded to us by Chris Jarrett-Davies <[email protected]>.

>How-To-Repeat:

	send arp packets with bogus op fields

>Fix:

	validate earlier on in arpintr or ip_arpinput