mirror of
https://github.com/tailscale/tailscale.git
synced 2026-09-20 18:48:51 -04:00
Brad Fitzpatrick
2a4ce5ba3b
A tailnet peer can remotely crash tailscaled by sending a DERP-sealed disco CallMeMaybeVia message with an all-zero ServerDisco key. The decoder accepts the zero key, and the relay manager later hands it to DiscoPrivate.Shared, which panics on zero keys. The sender only needs to be a relay-capable peer in the victim's netmap. Auditing the other DiscoPrivate.Shared call sites reachable from decoded messages turned up the same bug on the relay server side. AllocateUDPRelayEndpointRequest.ClientDisco is attacker-chosen: one slot must match the sender's disco key, and the other can be zero. It flows unchecked into udprelay.Server.AllocateEndpoint, which calls Shared on both client keys and panics in its eventbus subscriber goroutine. AllocateEndpoint now rejects zero client keys with an error, which its only caller already handles by logging. Thanks to Ben Carman for the report! Updates tailscale/corp#48187 Reported-by: Ben Carman Change-Id: Ifc0f64d8f63270100b22c06e9f759dce624ab811 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>