Actions
Security #7040
closeddefrag: id reuse can lead to invalid reassembly
Git IDs:
Severity:
CRITICAL
Disclosure Date:
Description
When 2 sets of fragments are sent with the same id in quick succession, the 2nd set may reuse the DefragTracker for the first set. This will lead to incorrect reassembly logic. An incomplete packet will be decoded, leading to decoder events and general policy bypass.
The issue is in DefragGetTrackerFromHash which does not respect the DefragTracker::remove field in all it's lookup paths.
Actions